31 lines
944 B
Diff
31 lines
944 B
Diff
From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001
|
|
From: Sergey Poznyakoff <gray@gnu.org>
|
|
Date: Sat, 11 Feb 2023 11:57:39 +0200
|
|
Subject: [PATCH] Fix boundary checking in base-256 decoder
|
|
|
|
* src/list.c (from_header): Base-256 encoding is at least 2 bytes
|
|
long.
|
|
---
|
|
src/list.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/list.c b/src/list.c
|
|
index 9fafc425..86bcfdd1 100644
|
|
--- a/src/list.c
|
|
+++ b/src/list.c
|
|
@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type,
|
|
where++;
|
|
}
|
|
}
|
|
- else if (*where == '\200' /* positive base-256 */
|
|
- || *where == '\377' /* negative base-256 */)
|
|
+ else if (where <= lim - 2
|
|
+ && (*where == '\200' /* positive base-256 */
|
|
+ || *where == '\377' /* negative base-256 */))
|
|
{
|
|
/* Parse base-256 output. A nonnegative number N is
|
|
represented as (256**DIGS)/2 + N; a negative number -N is
|
|
--
|
|
2.38.1
|
|
|