Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p)
  • Loading branch information
PetteriAimonen committed Feb 1, 2020
1 parent b2ce24f commit 45582f1
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions pb_decode.c
Expand Up @@ -720,11 +720,11 @@ static bool checkreturn decode_pointer_field(pb_istream_t *stream, pb_wire_type_
if (!check_wire_type(wire_type, field))
PB_RETURN_ERROR(stream, "wrong wire type");

(*size)++;
if (!allocate_field(stream, field->pField, field->data_size, *size))
if (!allocate_field(stream, field->pField, field->data_size, (size_t)(*size + 1)))
return false;

field->pData = *(char**)field->pField + field->data_size * (*size - 1);
field->pData = *(char**)field->pField + field->data_size * (*size);
(*size)++;
initialize_pointer_field(field->pData, field);
return decode_basic_field(stream, field);
}
Expand Down

0 comments on commit 45582f1

Please sign in to comment.