Skip to content

Commit f045fa4

Browse files
authored
add more size & type checks to C fasl reader (#1035)
1 parent 4b534e5 commit f045fa4

3 files changed

Lines changed: 98 additions & 59 deletions

File tree

c/alloc.c

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -799,16 +799,21 @@ ptr S_null_immutable_string(void) {
799799
}
800800

801801
static ptr stencil_vector(uptr type, uptr mask) {
802-
ptr tc;
803-
ptr p; iptr d;
804-
iptr n = Spopcount(mask);
802+
ptr tc;
803+
ptr p;
804+
iptr d;
805+
iptr n;
805806

806-
tc = get_thread_context();
807+
if (mask >= ((uptr)1 << stencil_vector_mask_bits))
808+
S_error("", "invalid stencil vector mask request");
807809

808-
d = size_stencil_vector(n);
809-
newspace_find_room(tc, type_typed_object, d, p);
810-
VECTTYPE(p) = (mask << stencil_vector_mask_offset) | type;
811-
return p;
810+
n = Spopcount(mask);
811+
tc = get_thread_context();
812+
813+
d = size_stencil_vector(n);
814+
newspace_find_room(tc, type_typed_object, d, p);
815+
VECTTYPE(p) = (mask << stencil_vector_mask_offset) | type;
816+
return p;
812817
}
813818

814819
ptr S_stencil_vector(uptr mask) {
@@ -1088,6 +1093,9 @@ ptr S_bignum(ptr tc, iptr n, IBOOL sign) {
10881093
ptr S_code(ptr tc, iptr type, iptr n) {
10891094
ptr p; iptr d;
10901095

1096+
if ((uptr)n > (uptr)most_positive_fixnum)
1097+
S_error("", "invalid code size request");
1098+
10911099
d = size_code(n);
10921100
find_room(tc, space_code, 0, type_typed_object, d, p);
10931101
CODETYPE(p) = type;
@@ -1103,6 +1111,9 @@ ptr S_relocation_table(iptr n) {
11031111
ptr tc = get_thread_context();
11041112
ptr p; iptr d;
11051113

1114+
if ((uptr)n > (uptr)most_positive_fixnum)
1115+
S_error("", "invalid relocation table size request");
1116+
11061117
d = size_reloc_table(n);
11071118
newspace_find_room(tc, type_untyped, d, p);
11081119
RELOCSIZE(p) = n;

0 commit comments

Comments
 (0)