luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2024-11-10 11:26:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ossfuzz-9805-variant-parser-overflow' into 'master'

Browse Source 
gvariant: Fix more bounds checking in GVariant text format parser

See merge request GNOME/glib!239
This commit is contained in:
Philip Withnall 2018-08-27 10:14:32 +00:00
commit 297941e049
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
glib/gvariant-parser.c
View File

@ -197,7 +197,8 @@ token_stream_prepare (TokenStream *stream)
break; break;
case 'b': case 'b':
if (stream->stream[1] == '\'' || stream->stream[1] == '"') if (stream->stream + 1 != stream->end &&
(stream->stream[1] == '\'' || stream->stream[1] == '"'))
{ {
for (end = stream->stream + 2; end != stream->end; end++) for (end = stream->stream + 2; end != stream->end; end++)
if (*end == stream->stream[1] || *end == '\0' || if (*end == stream->stream[1] || *end == '\0' ||

11
glib/tests/gvariant.c
View File

@ -3892,6 +3892,17 @@ test_parse_failures (void)
"string 4", "7-8:", "can not parse as", "string 4", "7-8:", "can not parse as",
"\x0a", "1:", "expected value", "\x0a", "1:", "expected value",
"((", "2:", "expected value", "((", "2:", "expected value",
"(b", "1:", "expected value",
"b'", "0-2:", "unterminated string constant",
"b\"", "0-2:", "unterminated string constant",
"b'a", "0-3:", "unterminated string constant",
"b\"a", "0-3:", "unterminated string constant",
"b'\\", "0-3:", "unterminated string constant",
"b\"\\", "0-3:", "unterminated string constant",
"b'\\'", "0-4:", "unterminated string constant",
"b\"\\\"", "0-4:", "unterminated string constant",
"b'\\'a", "0-5:", "unterminated string constant",
"b\"\\\"a", "0-5:", "unterminated string constant",
}; };
gint i; gint i;