mirror/guile
mirror/guile
1
Fork 0
mirror of https://git.savannah.gnu.org/git/guile.git synced 2025-06-27 13:30:31 +02:00
Code Activity

fix write-beyond-end of an on-stack buffer while reading typed arrays

Browse source 
* libguile/unif.c (scm_i_read_array): Fix case in which we could write
  beyond the end of `tag'.  See
  http://article.gmane.org/gmane.lisp.guile.devel/12685.
This commit is contained in:
Andy Wingo 2011-07-29 09:31:32 +02:00
parent b720f24494
commit 99c6be814f
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
libguile/unif.c
View file

@ -1,4 +1,4 @@
/* Copyright (C) 1995,1996,1997,1998,2000,2001,2002,2003,2004, 2005, 2006 Free Software Foundation, Inc.
/* Copyright (C) 1995,1996,1997,1998,2000,2001,2002,2003,2004, 2005, 2006, 2011 Free Software Foundation, Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@ -2722,7 +2722,7 @@ scm_i_read_array (SCM port, int c)
*/
tag_len = 0;
continue_reading_tag:
while (c != EOF && c != '(' && c != '@' && c != ':' && tag_len < 80)
while (c != EOF && c != '(' && c != '@' && c != ':' && tag_len < 79)
{
tag[tag_len++] = c;
c = scm_getc (port);