mirror of
https://github.com/weechat/weechat.git
synced 2026-06-26 21:06:38 +02:00
Fixed segfault during excessive evaluation.
It is possible to trigger a segmentation fault while processing
an evaluation of repeating string. On a Linux 64 bit system,
enter this (or adjust arguments for 32 bit accordingly):
/eval -n ${repeat:1073741824,----}
It will overflow an integer calculation because int instead of
size_t is used. Proper check of int limitations fixes this issue.
I haven't changed this specific piece of code to size_t because it
would crash in other parts of the code tree instead. For now, int
is a limitating factor when it comes to strings (and should be
enough for sane use cases).
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
This commit is contained in:
committed by
Sébastien Helleu
parent
63a05d72d9
commit
f7b84fcc67
@@ -26,6 +26,7 @@ extern "C"
|
||||
#ifndef HAVE_CONFIG_H
|
||||
#define HAVE_CONFIG_H
|
||||
#endif
|
||||
#include <limits.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@@ -300,6 +301,8 @@ TEST(CoreString, Reverse)
|
||||
TEST(CoreString, Repeat)
|
||||
{
|
||||
POINTERS_EQUAL(NULL, string_repeat (NULL, 1));
|
||||
POINTERS_EQUAL(NULL, string_repeat ("----", INT_MAX / 4));
|
||||
|
||||
STRCMP_EQUAL("", string_repeat ("", 1));
|
||||
|
||||
STRCMP_EQUAL("", string_repeat ("x", -1));
|
||||
|
||||
Reference in New Issue
Block a user