Permalink
Browse files

*fixed segfault (affects all flavors) where creating an expr object w…

…ith more than MAX_VARS variables (currently set to 9) crashed pd when freeing the object. Example: create [expr 1;2;3;4;5;6;7;8;9;10] as opposed to [expr 1;2;3;4;5;6;7;8;9]. Former crashes when being freed (destroyed), while latter doesn't.
  • Loading branch information...
1 parent 43a2cb9 commit 533d630db3f5bd01ca42eb4d4a9a408d181b0de2 @pd-l2ork committed Mar 5, 2014
Showing with 5 additions and 0 deletions.
  1. +5 −0 pd/extra/expr~/vexp.c
@@ -265,6 +265,11 @@ expr_donew(struct expr *expr, int ac, t_atom *av)
(struct ex_ex *)fts_malloc(max_node * sizeof (struct ex_ex));
expr->exp_nexpr++;
ret = ex_match(list, (long)0);
+ if (expr->exp_nexpr > MAX_VARS) // we cannot exceed the number of max vars (arbitrarily set to 9 in vexp.h)
+ {
+ post_error((fts_object_t *) expr, "expr: too many variables (maximum %d allowed)", MAX_VARS);
+ goto error;
+ }
if (!ret) /* syntax error */
goto error;
ret = ex_parse(expr,

0 comments on commit 533d630

Please sign in to comment.