Skip to content

Commit 1f9d124

Browse files
committed
xkbcomp: fix stack overflow when evaluating boolean negation
The expression evaluator would go into an infinite recursion when evaluating something like this as a boolean: `!True`. Instead of recursing to just `True` and negating, it recursed to `!True` itself again. Bug inherited from xkbcomp. Caught with the afl fuzzer. Signed-off-by: Ran Benita <ran234@gmail.com>
1 parent 2cb5c2a commit 1f9d124

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

Diff for: src/xkbcomp/expr.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ ExprResolveBoolean(struct xkb_context *ctx, const ExprDef *expr,
165165

166166
case EXPR_INVERT:
167167
case EXPR_NOT:
168-
ok = ExprResolveBoolean(ctx, expr, set_rtrn);
168+
ok = ExprResolveBoolean(ctx, expr->unary.child, set_rtrn);
169169
if (ok)
170170
*set_rtrn = !*set_rtrn;
171171
return ok;

0 commit comments

Comments
 (0)