d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

unifdef: fix invalid array access when nesting limit exceeded

Browse Source 
If the number of nested #if blocks exceeds 64, nest() increments
the nesting depth and then reports an error.  The message includes
the line number for the start of the current #if block, which is
read from past the end of the relevant array.

Avoid the out-of-bounds read by reporting the error and exiting
before the nesting depth has a chance to increase.

Submitted by: Jonathan Nieder <jrnieder@gmail.com>
This commit is contained in:
Tony Finch 2009-11-27 17:53:49 +00:00
parent dec7fa27c6
commit 137f2acad4
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=199867
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
usr.bin/unifdef/unifdef.c
View File

@ -24,17 +24,19 @@
*/
/*
* This code is derived from software contributed to Berkeley by Dave Yost.
* This code was derived from software contributed to Berkeley by Dave Yost.
* It was rewritten to support ANSI C by Tony Finch. The original version
* of unifdef carried the 4-clause BSD copyright licence. None of its code
* remains in this version (though some of the names remain) so it now
* carries a more liberal licence.
*
* The latest version is available from http://dotat.at/prog/unifdef
*/
#include <sys/cdefs.h>
#ifdef __IDSTRING
__IDSTRING(dotat, "$dotat: unifdef/unifdef.c,v 1.188 2009/11/25 00:11:02 fanf2 Exp $");
__IDSTRING(dotat, "$dotat: unifdef/unifdef.c,v 1.190 2009/11/27 17:21:26 fanf2 Exp $");
#endif
#ifdef __FBSDID
__FBSDID("$FreeBSD$");
@ -460,9 +462,11 @@ keywordedit(const char *replacement)
static void
nest(void)
{
depth += 1;
if (depth >= MAXDEPTH)
if (depth > MAXDEPTH-1)
abort(); /* bug */
if (depth == MAXDEPTH-1)
error("Too many levels of nesting");
depth += 1;
stifline[depth] = linenum;
}
static void