diff options
| author | Michael Ridgway <michael.ridgway@monsec.io> | 2026-05-15 16:07:34 +1000 |
|---|---|---|
| committer | dana <dana@dana.is> | 2026-05-21 20:45:48 -0500 |
| commit | 4cbaf85c4495dc78d5dc7303f9ef8edc155552a0 (patch) | |
| tree | fb8afce6c6f3fec7ff8da6f6f4a4411c6a03d2b7 /Src/parse.c | |
| parent | unposted: tests: add regression test for w/54583 (diff) | |
| download | zsh-4cbaf85c4495dc78d5dc7303f9ef8edc155552a0.tar zsh-4cbaf85c4495dc78d5dc7303f9ef8edc155552a0.tar.gz zsh-4cbaf85c4495dc78d5dc7303f9ef8edc155552a0.tar.bz2 zsh-4cbaf85c4495dc78d5dc7303f9ef8edc155552a0.tar.lz zsh-4cbaf85c4495dc78d5dc7303f9ef8edc155552a0.tar.xz zsh-4cbaf85c4495dc78d5dc7303f9ef8edc155552a0.tar.zst zsh-4cbaf85c4495dc78d5dc7303f9ef8edc155552a0.zip | |
54571: bound h->npats in .zwc loader
Diffstat (limited to 'Src/parse.c')
| -rw-r--r-- | Src/parse.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/Src/parse.c b/Src/parse.c index 21b95bcb7..4012b171a 100644 --- a/Src/parse.c +++ b/Src/parse.c @@ -3882,10 +3882,14 @@ check_dump_file(char *file, struct stat *sbuf, char *name, int *ksh, #ifdef USE_MMAP if (f) { - Eprog prog = (Eprog) zalloc(sizeof(*prog)); + Eprog prog; Patprog *pp; - int np; + size_t np; + + if (h->npats > h->len / sizeof(wordcode)) + return NULL; + prog = (Eprog) zalloc(sizeof(*prog)); prog->flags = EF_MAP; prog->len = h->len; prog->npats = np = h->npats; @@ -3917,7 +3921,12 @@ check_dump_file(char *file, struct stat *sbuf, char *name, int *ksh, { Eprog prog; Patprog *pp; - int np, fd, po = h->npats * sizeof(Patprog); + int fd; + size_t np, po; + + if (h->npats > h->len / sizeof(wordcode)) + return NULL; + po = h->npats * sizeof(Patprog); if ((fd = open(file, O_RDONLY)) < 0 || lseek(fd, ((h->start * sizeof(wordcode)) + |