Bladeren bron

Fix out-of-bounds read in RemoveLineComments

Follow up to 6f07e89fdfb, which was not sufficient to fix the bug.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24553
Alex Rebert 3 jaren geleden
bovenliggende
commit
145f972d76
1 gewijzigde bestanden met toevoegingen van 7 en 15 verwijderingen
  1. 7 15
      code/Common/RemoveComments.cpp

+ 7 - 15
code/Common/RemoveComments.cpp

@@ -65,27 +65,19 @@ void CommentRemover::RemoveLineComments(const char* szComment,
         len = lenBuffer;
     }
 
-    char *szCurrent = szBuffer;
-    while (*szCurrent)   {
-
+    for(size_t i = 0; i < lenBuffer; i++) {
         // skip over quotes
-        if (*szCurrent == '\"' || *szCurrent == '\'')
-            while (*szCurrent++ && *szCurrent != '\"' && *szCurrent != '\'');
+        if (szBuffer[i] == '\"' || szBuffer[i] == '\'')
+            while (++i < lenBuffer && szBuffer[i] != '\"' && szBuffer[i] != '\'');
 
-        size_t lenRemaining = lenBuffer - (szCurrent - szBuffer);
-        if(lenRemaining < len) {
+        if(lenBuffer - i < len) {
             break;
         }
 
-        if (!strncmp(szCurrent,szComment,len)) {
-            while (!IsLineEnd(*szCurrent))
-                *szCurrent++ = chReplacement;
-
-            if (!*szCurrent) {
-                break;
-            }
+        if (!strncmp(szBuffer + i,szComment,len)) {
+            while (i < lenBuffer && !IsLineEnd(szBuffer[i]))
+                szBuffer[i++] = chReplacement;
         }
-        ++szCurrent;
     }
 }