Fixing potential buffer overflow.

This commit is contained in:
Alex Shinn 2012-11-11 14:36:11 +09:00
parent a9f4f3edd3
commit 28f49d5252

3
sexp.c
View file

@ -2150,7 +2150,7 @@ sexp sexp_read_string (sexp ctx, sexp in, int sentinel) {
len = sexp_utf8_char_byte_count(c); len = sexp_utf8_char_byte_count(c);
sexp_utf8_encode_char((unsigned char*)buf + i, len, c); sexp_utf8_encode_char((unsigned char*)buf + i, len, c);
i += len; i += len;
continue; goto maybe_expand;
} }
#endif #endif
} }
@ -2168,6 +2168,7 @@ sexp sexp_read_string (sexp ctx, sexp in, int sentinel) {
break; break;
} }
buf[i++] = c; buf[i++] = c;
maybe_expand:
if (i+4 >= size) { /* expand buffer w/ malloc(), later free() it */ if (i+4 >= size) { /* expand buffer w/ malloc(), later free() it */
tmp = (char*) sexp_malloc(size*2); tmp = (char*) sexp_malloc(size*2);
if (!tmp) {res = sexp_global(ctx, SEXP_G_OOM_ERROR); break;} if (!tmp) {res = sexp_global(ctx, SEXP_G_OOM_ERROR); break;}