Skip to content
Snippets Groups Projects
Commit 7f22ef3c authored by Augie Fackler's avatar Augie Fackler
Browse files

mpatch: fix UB integer overflows in discard() (SEC)

parent 0b208c13
No related branches found
No related tags found
No related merge requests found
......@@ -172,6 +172,10 @@
int postend, c, l;
while (s != src->tail) {
if (s->start + offset >= cut)
int cmpcut = s->start;
if (!safeadd(offset, &cmpcut)) {
break;
}
if (cmpcut >= cut)
break;
......@@ -176,4 +180,10 @@
break;
postend = offset + s->start + s->len;
postend = offset;
if (!safeadd(s->start, &postend)) {
break;
}
if (!safeadd(s->len, &postend)) {
break;
}
if (postend <= cut) {
......@@ -179,4 +189,15 @@
if (postend <= cut) {
offset += s->start + s->len - s->end;
/* do the subtraction first to avoid UB integer overflow
*/
int tmp = s->start;
if (!safesub(s->end, &tmp)) {
break;
}
if (!safeadd(s->len, &tmp)) {
break;
}
if (!safeadd(tmp, &offset)) {
break;
}
s++;
} else {
......@@ -181,6 +202,9 @@
s++;
} else {
c = cut - offset;
c = cut;
if (!safesub(offset, &c)) {
break;
}
if (s->end < c)
c = s->end;
l = cut - offset - s->start;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment