storm/w3m
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

One more fix overflow due to Strgrow

Browse Source 
Bug-Chromium: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31397
This commit is contained in:
Tatsuya Kinoshita
2021-02-27 09:17:07 +09:00
parent 1256cd6d0d
commit 31d0457609
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Str.c
View File

@@ -26,7 +26,7 @@
#include "myctype.h" #include "myctype.h"
#define INITIAL_STR_SIZE 32 #define INITIAL_STR_SIZE 32
#define STR_SIZE_MAX INT_MAX #define STR_SIZE_MAX (INT_MAX - 1)
#ifdef STR_DEBUG #ifdef STR_DEBUG
/* This is obsolete, because "Str" can handle a '\0' character now. */ /* This is obsolete, because "Str" can handle a '\0' character now. */
@@ -259,8 +259,11 @@ Strgrow(Str x)
newlen = x->area_size * 6 / 5; newlen = x->area_size * 6 / 5;
if (newlen == x->area_size) if (newlen == x->area_size)
newlen += 2; newlen += 2;
if (newlen < 0 || newlen > STR_SIZE_MAX) if (newlen < 0 || newlen > STR_SIZE_MAX) {
newlen = STR_SIZE_MAX; newlen = STR_SIZE_MAX;
if (x->length + 1 >= newlen)
x->length = newlen - 2;
}
x->ptr = GC_MALLOC_ATOMIC(newlen); x->ptr = GC_MALLOC_ATOMIC(newlen);
x->area_size = newlen; x->area_size = newlen;
bcopy((void *)old, (void *)x->ptr, x->length); bcopy((void *)old, (void *)x->ptr, x->length);