From 889f6af37164775192e33b233a90e86fd3df0f57 Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Sat, 2 Sep 2023 19:43:33 +0200 Subject: [PATCH 22/52] patch 9.0.1847: [security] potential oob write in do_addsub() Problem: potential oob write in do_addsub() Solution: don't overflow buf2, check size in for loop() Signed-off-by: Christian Brabandt --- src/ops.c | 2 +- 1 files changed, 1 insertions(+), 1 deletion(-) diff --git a/src/ops.c b/src/ops.c index d46a049fe..f4524d3d7 100644 --- a/src/ops.c +++ b/src/ops.c @@ -2848,7 +2848,7 @@ do_addsub( for (bit = bits; bit > 0; bit--) if ((n >> (bit - 1)) & 0x1) break; - for (i = 0; bit > 0; bit--) + for (i = 0; bit > 0 && i < (NUMBUFLEN - 1); bit--) buf2[i++] = ((n >> (bit - 1)) & 0x1) ? '1' : '0'; buf2[i] = '\0'; -- 2.33.0