Procházet zdrojové kódy

Fixed a `container-overflow` error (#6298)

* Fixed a container-overflow error in `ODDLParser::OpenDDLParser::parseIntegerLiteral` by swapping the order of conditions in a while loop to ensure the end-of-buffer check happens before dereferencing the pointer. This prevents reading past the end of the buffer when lookForNextToken returns the end pointer.

https://oss-fuzz.com/testcase-detail/4980126616780800
https://issues.oss-fuzz.com/issues/42527625

* Update OpenDDLParser.cpp
Dongge Liu před 1 měsícem
rodič
revize
13316790aa
1 změnil soubory, kde provedl 3 přidání a 3 odebrání
  1. 3 3
      contrib/openddlparser/code/OpenDDLParser.cpp

+ 3 - 3
contrib/openddlparser/code/OpenDDLParser.cpp

@@ -655,7 +655,7 @@ char *OpenDDLParser::parseBooleanLiteral(char *in, char *end, Value **boolean) {
     char *start(in);
     char *start(in);
 
 
     size_t len(0);
     size_t len(0);
-    while (!isSeparator(*in) && in != end) {
+    while (in != end && !isSeparator(*in)) {
         ++in;
         ++in;
         ++len;
         ++len;
     }
     }
@@ -688,7 +688,7 @@ char *OpenDDLParser::parseIntegerLiteral(char *in, char *end, Value **integer, V
 
 
     in = lookForNextToken(in, end);
     in = lookForNextToken(in, end);
     char *start(in);
     char *start(in);
-    while (!isSeparator(*in) && in != end) {
+    while (in != end && !isSeparator(*in)) {
         ++in;
         ++in;
     }
     }
 
 
@@ -831,7 +831,7 @@ char *OpenDDLParser::parseHexaLiteral(char *in, char *end, Value **data) {
     bool ok(true);
     bool ok(true);
     char *start(in);
     char *start(in);
     int pos(0);
     int pos(0);
-    while (!isSeparator(*in) && in != end) {
+    while (in != end && !isSeparator(*in)) {
         if ((*in < '0' && *in > '9') || (*in < 'a' && *in > 'f') || (*in < 'A' && *in > 'F')) {
         if ((*in < '0' && *in > '9') || (*in < 'a' && *in > 'f') || (*in < 'A' && *in > 'F')) {
             ok = false;
             ok = false;
             break;
             break;