瀏覽代碼

Fix OOB read (2) in OpenDDLParser::parsePrimitiveDataType (#6316)

Co-authored-by: Kim Kulling <[email protected]>
Kyungjoon Ko 3 周之前
父節點
當前提交
3a0ee8792f
共有 1 個文件被更改,包括 4 次插入1 次删除
  1. 4 1
      contrib/openddlparser/code/OpenDDLParser.cpp

+ 4 - 1
contrib/openddlparser/code/OpenDDLParser.cpp

@@ -595,6 +595,9 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
     } else {
         in += prim_len;
     }
+    if (in >= end) {
+        return in;
+    }
 
     bool ok(true);
     if (*in == Grammar::OpenArrayToken[0]) {
@@ -602,13 +605,13 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
         ++in;
         char *start(in);
         while (in != end) {
-            ++in;
             if (*in == Grammar::CloseArrayToken[0]) {
                 len = ::atoi(start);
                 ok = true;
                 ++in;
                 break;
             }
+            ++in;
         }
     } else {
         len = 1;