Front page | perl.perl5.porters |
Postings from December 2005
Dave Mitchell <davem@iabyn.com> wrote:
:On Wed, Nov 30, 2005 at 10:15:03AM +0100, Rafael Garcia-Suarez wrote:
:> 2. Moreover, this kind of vulnerability can be exploited
:> to a buffer overrun in the perl interpreter, by taking
:> advantage of an int<->unsigned int conversion bug in the
:> printf handling code
:
:Fixed by the change below.
[...]
:==== //depot/perl/sv.c#1028 (text) ====
:
:@@ -8359,9 +8359,10 @@
:
: if (vectorize)
: argsv = vecsv;
:- else if (!args)
:- argsv = (efix ? efix <= svmax : svix < svmax) ?
:- svargs[efix ? efix-1 : svix++] : &PL_sv_undef;
:+ else if (!args) {
:+ I32 i = efix ? efix-1 : svix++;
:+ argsv = (i >= 0 && i < svmax) ? svargs[i] : &PL_sv_undef;
:+ }
:
: switch (c = *q++) {
If (!efix && svix >= svmax) this will now svix++ where it didn't before.
I can't offhand think of a way this could cause problems - I assume you
can't construct an [IU]V_MAX argument list - but it seems worth flagging.
Hugo
Thread Previous
|
Thread Next