Date: Fri, 2 Dec 2016 16:41:08 +0000 (UTC) From: "Pedro F. Giffuni" <pfg@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r309418 - head/usr.bin/indent Message-ID: <201612021641.uB2Gf8YK011761@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: pfg Date: Fri Dec 2 16:41:08 2016 New Revision: 309418 URL: https://svnweb.freebsd.org/changeset/base/309418 Log: indent(1): Avoid out-of-bound accesses of arrays. ps.paren_indents: When ps.paren_level was 0, this was accessing paren_indents[-1]. in_buffer: This fragment checks if "*/" was read, but there's no guarantee that there is more than one byte in the array (actually, this happens frequently for the "{" in things like "int main(void) {"). Submitted by: Piotr Stefaniak Modified: head/usr.bin/indent/io.c Modified: head/usr.bin/indent/io.c ============================================================================== --- head/usr.bin/indent/io.c Fri Dec 2 16:32:14 2016 (r309417) +++ head/usr.bin/indent/io.c Fri Dec 2 16:41:08 2016 (r309418) @@ -278,7 +278,8 @@ inhibit_newline: *(e_com = s_com = combuf + 1) = '\0'; ps.ind_level = ps.i_l_follow; ps.paren_level = ps.p_l_follow; - paren_target = -ps.paren_indents[ps.paren_level - 1]; + if (ps.paren_level > 0) + paren_target = -ps.paren_indents[ps.paren_level - 1]; not_first_line = 1; } @@ -371,7 +372,7 @@ fill_buffer(void) } buf_ptr = in_buffer; buf_end = p; - if (p[-2] == '/' && p[-3] == '*') { + if (p - in_buffer > 2 && p[-2] == '/' && p[-3] == '*') { if (in_buffer[3] == 'I' && strncmp(in_buffer, "/**INDENT**", 11) == 0) fill_buffer(); /* flush indent error message */ else {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201612021641.uB2Gf8YK011761>