admin/mlib
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix buffer overflow in ARRAY _pop_at function (reported by tyrone718)

Browse Source
This commit is contained in:
Patrick Pelissier committed 2021-09-18 09:52:33 +02:00
1 parent 2178dcfcab
commit 39eeb3aec7
2 files changed
+16 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

m-array.h
+1 -1
View File
@@ -553,7 +553,7 @@
M_DO_MOVE (oplist, *dest, v->ptr[i]); \
else \
M_CALL_CLEAR(oplist, v->ptr[i]); \
memmove(&v->ptr[i], &v->ptr[i+1], sizeof(type)*(v->size - i) ); \
memmove(&v->ptr[i], &v->ptr[i+1], sizeof(type)*(v->size-1-i)); \
v->size--; \
M_ARRA4_CONTRACT(v); \
} \
tests/test-marray.c
+15
View File
@@ -363,6 +363,21 @@ static void test_double(void)
assert (*i == ref);
ref += 1.0;
}
// Test of buffer overflow (with address sanitizer)
// _init_set provides an allocated buffer of the exact needed size
ArrayDouble tab1;
array_double_init_set(tab1, tab);
array_double_pop_at(NULL, tab1, 0);
array_double_clear(tab1);
array_double_init_set(tab1, tab);
array_double_insert_v(tab1, 0, 2);
array_double_clear(tab1);
array_double_init_set(tab1, tab);
array_double_remove_v(tab1, 0, 1);
array_double_clear(tab1);
array_double_init_set(tab1, tab);
array_double_push_at(tab1, 0, 2.);
array_double_clear(tab1);
}
assert( array_double_empty_p(g_array));