Skip to content

Commit a0b5e35

Browse files
committed
ATRONIX: by Shixin Zeng - Pass correct length to Deline_*
The length of the VAL_SERIES(value) has been set correctly by Append_UTF8, and it could be smaller than "len", because UTF8 is a multi-byte encoding, thus passing "len" to Deline_Uni could cause out-of-bound memory access. Fixes CC#2169 The following code REBOL[] t: <ēee> causes: ==13053==ERROR: AddressSanitizer: use-after-poison on address 0x61d00001a5f8 at pc 0x000000853d50 bp 0x7ffd2a31a1b0 sp 0x7ffd2a31a1a8 WRITE of size 2 at 0x61d00001a5f8 thread T0 0 0x853d4f in Deline_Uni /home/zsx/stuffs/work/r3.git/make/../src/core/s-ops.c:426:2 1 0x7064d4 in Scan_Any /home/zsx/stuffs/work/r3.git/make/../src/core/l-types.c:846:7 ...
1 parent 6261053 commit a0b5e35

File tree

1 file changed

+2
-4
lines changed

1 file changed

+2
-4
lines changed

src/core/l-types.c

+2-4
Original file line numberDiff line numberDiff line change
@@ -835,13 +835,11 @@ bad_hex: Trap0(RE_INVALID_CHARS);
835835

836836
VAL_SET(value, type);
837837
VAL_SERIES(value) = Append_UTF8(0, cp, len);
838-
VAL_INDEX(value) = 0;
839-
VAL_TAIL(value) = len;
840838

841839
if (VAL_BYTE_SIZE(value)) {
842-
n = Deline_Bytes(VAL_BIN(value), len);
840+
n = Deline_Bytes(VAL_BIN(value), VAL_LEN(value));
843841
} else {
844-
n = Deline_Uni(VAL_UNI(value), len);
842+
n = Deline_Uni(VAL_UNI(value), VAL_LEN(value));
845843
}
846844
VAL_TAIL(value) = n;
847845

0 commit comments

Comments
 (0)