Browse Source

Fix OOB read (2) in OpenDDLParser::parsePrimitiveDataType (#6316)

Co-authored-by: Kim Kulling <[email protected]>
Kyungjoon Ko 3 weeks ago
parent
commit
3a0ee8792f
1 changed files with 4 additions and 1 deletions
  1. 4 1
      contrib/openddlparser/code/OpenDDLParser.cpp

+ 4 - 1
contrib/openddlparser/code/OpenDDLParser.cpp

@@ -595,6 +595,9 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
     } else {
     } else {
         in += prim_len;
         in += prim_len;
     }
     }
+    if (in >= end) {
+        return in;
+    }
 
 
     bool ok(true);
     bool ok(true);
     if (*in == Grammar::OpenArrayToken[0]) {
     if (*in == Grammar::OpenArrayToken[0]) {
@@ -602,13 +605,13 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
         ++in;
         ++in;
         char *start(in);
         char *start(in);
         while (in != end) {
         while (in != end) {
-            ++in;
             if (*in == Grammar::CloseArrayToken[0]) {
             if (*in == Grammar::CloseArrayToken[0]) {
                 len = ::atoi(start);
                 len = ::atoi(start);
                 ok = true;
                 ok = true;
                 ++in;
                 ++in;
                 break;
                 break;
             }
             }
+            ++in;
         }
         }
     } else {
     } else {
         len = 1;
         len = 1;