Skip to content

Commit 9e2f7ad

Browse files
committed
ATRONIX: by Shixin Zeng - Do not increase tail before extension
It will confuse Expand_Series expects "tail" to be the actual size, and cause a read beyond the allocated memory, or heap buffer overflow found by address sanitizer of GCC: ================================================================= ==10856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00000b201 at pc 0x47df61 bp 0x7fffffff2ca0 sp 0x7fffffff2c98 READ of size 1 at 0x62a00000b201 thread T0 0 0x47df60 in Expand_Series ../src/core/m-series.c:145 1 0x47e5a7 in Extend_Series ../src/core/m-series.c:187 ...
1 parent 679215e commit 9e2f7ad

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

src/core/l-scan.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -459,7 +459,9 @@
459459

460460
*UNI_SKIP(buf, buf->tail) = chr;
461461

462-
if (++(buf->tail) >= SERIES_REST(buf)) Extend_Series(buf, 1);
462+
if (SERIES_LEN(buf) >= SERIES_REST(buf)) Extend_Series(buf, 1);
463+
464+
buf->tail ++;
463465
}
464466

465467
src++; // Skip ending quote or brace.

0 commit comments

Comments
 (0)