Skip to content

Commit

Permalink
ATRONIX: Check overflow of size calculation in series expansion
Browse files Browse the repository at this point in the history
This fixes the crash caused by (turn it into an exception):

a: read %/bin/ls
b: make binary! 1024
loop 20000 [
	append b a
]

(cherry picked from commit e1e8891)
  • Loading branch information
Oldes committed Sep 21, 2018
1 parent afb3282 commit 7eca4c3
Showing 1 changed file with 12 additions and 2 deletions.
14 changes: 12 additions & 2 deletions src/core/m-series.c
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@
***********************************************************************/
{
REBCNT start;
REBCNT size;
REBCNT size, new_size;
REBCNT extra;
REBCNT wide;
REBSER *newser, swap;
Expand Down Expand Up @@ -112,7 +112,17 @@
#ifdef DEBUGGING
Print_Num("Expand:", series->tail + delta + 1);
#endif
newser = Make_Series(series->tail + delta + x, wide, TRUE);
new_size = series->tail + delta + x;
if (new_size < series->tail
|| new_size < delta
|| new_size < x
|| new_size < series->tail + delta
|| new_size < series->tail + x
|| new_size < delta + x) {
Trap0(RE_PAST_END);
}

newser = Make_Series(new_size, wide, TRUE);
// If necessary, add series to the recently expanded list:
if (Prior_Expand[n] != series) {
n = (REBUPT)(Prior_Expand[0]) + 1;
Expand Down

0 comments on commit 7eca4c3

Please sign in to comment.