Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed nasty segfault in vasm.c #10785

Merged
merged 2 commits into from Jul 23, 2018
Merged

Fixed nasty segfault in vasm.c #10785

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1eadef5
Fixed buffer overflow in vasm.c
cyanpencil Jul 19, 2018
061bd8d
Fixed a->codebuf not null terminated in vasm.c
cyanpencil Jul 22, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 8 additions & 3 deletions libr/core/vasm.c
View file
Open in desktop
Expand Up @@ -2,10 +2,12 @@

#include <r_core.h>

#define R_VISUAL_ASM_BUFSIZE 1024

typedef struct {
RCore *core;
char blockbuf[1024];
char codebuf[1024];
char blockbuf[R_VISUAL_ASM_BUFSIZE];
char codebuf[R_VISUAL_ASM_BUFSIZE];
int oplen;
ut8 buf[128];
RAsmCode *acode;
Expand Down Expand Up @@ -38,9 +40,12 @@ static int readline_callback(void *_a, const char *str) {
r_cons_print ("\n\n");
}
if (a->acode) {
xlen = strlen (a->acode->buf_hex);
xlen = R_MIN (strlen (a->acode->buf_hex), R_VISUAL_ASM_BUFSIZE - 2);
strcpy (a->codebuf, a->blockbuf);
memcpy (a->codebuf, a->acode->buf_hex, xlen);
if (xlen >= strlen (a->blockbuf)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't looks right. It is OOB write if xlen > strlen (a->codebuf). Please handle this case too.

a->codebuf[xlen] = '\0';
}
}
{
int rows = 0;
Expand Down