texinfo-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[7647] adjust_nodestart avoid searching outside of file buffer


From: gavinsmith0123
Subject: [7647] adjust_nodestart avoid searching outside of file buffer
Date: Mon, 23 Jan 2017 14:47:08 -0500 (EST)

Revision: 7647
          http://svn.sv.gnu.org/viewvc/?view=rev&root=texinfo&revision=7647
Author:   gavin
Date:     2017-01-23 14:47:08 -0500 (Mon, 23 Jan 2017)
Log Message:
-----------
adjust_nodestart avoid searching outside of file buffer

Modified Paths:
--------------
    trunk/ChangeLog
    trunk/info/nodes.c

Modified: trunk/ChangeLog
===================================================================
--- trunk/ChangeLog     2017-01-21 20:36:10 UTC (rev 7646)
+++ trunk/ChangeLog     2017-01-23 19:47:08 UTC (rev 7647)
@@ -1,3 +1,11 @@
+2017-01-23  Gavin Smith  <address@hidden>
+
+       * info/nodes.c (adjust_nodestart): Check that both the start and 
+       end of the region where we search for the node separator are
+       within the file buffer, to avoid invalidly reading memory in 
+       case the file tags table had an incorrect offset.  Invalid read
+       reported by Hanno B\xF6ck.
+
 2017-01-21  Gavin Smith  <address@hidden>
 
        * info/nodes.c (get_tags_of_indirect_tags_table): Check if 

Modified: trunk/info/nodes.c
===================================================================
--- trunk/info/nodes.c  2017-01-21 20:36:10 UTC (rev 7646)
+++ trunk/info/nodes.c  2017-01-23 19:47:08 UTC (rev 7647)
@@ -2,7 +2,8 @@
    $Id$
 
    Copyright 1993, 1998, 1999, 2000, 2002, 2003, 2004, 2006, 2007,
-   2008, 2009, 2011, 2012, 2013, 2014, 2015 Free Software Foundation, Inc.
+   2008, 2009, 2011, 2012, 2013, 2014, 2015, 2016, 2017 Free Software 
+   Foundation, Inc.
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -1192,6 +1193,8 @@
 
       if (s.start < 0)
         s.start = 0;
+      else if (s.start > fb->filesize)
+        s.start = fb->filesize;
       if (s.end > fb->filesize)
         s.end = fb->filesize;
 




reply via email to

[Prev in Thread] Current Thread [Next in Thread]