Skip to content

Commit 679215e

Browse files
committed
ATRONIX: by Shixin Zeng - Fix a crash caused by integer underflow
index is unsigned, and could be zero, so 'index--' will underflow and round to 0xffffffff, and cause problem in a later call to Expand_Series I believe the idea of if ((REBINT)index > i) index--; is to move the index forward because gob being inserted were in PANE, and they can't be there twice (Detach_Gob will remove them from the current gob). So if they were not there, "index" shouldn't be changed. This fixes a crash in the following script: REBOL [] foo: make block! [] for i 0 15 1 [ txt: #"a" + i append foo make gob! reduce/no-set [text: to string! txt] ] g: make gob! [] append g foo g/pane: next g/pane With this stack trace: zsx@touchsmart-arch:~/work/r3.git/make$ R3_ALWAYS_MALLOC=1 ./r3-view-linux test-insert-gob-crash.r ================================================================= ==24248==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d00000c8a8 at pc 0x522243 bp 0x7fff91ba7a60 sp 0x7fff91ba7a50 WRITE of size 8 at 0x60d00000c8a8 thread T0 0 0x522242 in Insert_Gobs ../src/core/t-gob.c:230 1 0x5242d6 in Set_GOB_Var ../src/core/t-gob.c:421 ...
1 parent b46f6e9 commit 679215e

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/core/t-gob.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ const REBCNT Gob_Flag_Words[] = {
189189
}
190190
}
191191
Detach_Gob(VAL_GOB(val));
192-
if ((REBINT)index > i) index--;
192+
if (i >= 0 && (REBINT)index > i) index--;
193193
}
194194
}
195195
}

0 commit comments

Comments
 (0)