| From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001 |
| From: Sergey Poznyakoff <gray@gnu.org> |
| Date: Sat, 11 Feb 2023 11:57:39 +0200 |
| Subject: Fix boundary checking in base-256 decoder |
| |
| * src/list.c (from_header): Base-256 encoding is at least 2 bytes |
| long. |
| |
| src/list.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| diff --git a/src/list.c b/src/list.c |
| index 9fafc42..86bcfdd 100644 |
| |
| |
| @@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type, |
| where++; |
| } |
| } |
| - else if (*where == '\200' /* positive base-256 */ |
| - || *where == '\377' /* negative base-256 */) |
| + else if (where <= lim - 2 |
| + && (*where == '\200' /* positive base-256 */ |
| + || *where == '\377' /* negative base-256 */)) |
| { |
| /* Parse base-256 output. A nonnegative number N is |
| represented as (256**DIGS)/2 + N; a negative number -N is |
| -- |
| cgit v1.1 |
| |