mirrors/janet
1
0
Fork 0
mirror of https://github.com/janet-lang/janet synced 2025-11-05 10:03:06 +00:00
Code Issues 1 Releases Wiki Activity

Fix use after free in buffer/push-string.

Browse Source
This commit is contained in:
Andrew Chambers
2019-05-08 20:08:20 +12:00
committed by Calvin Rose
parent fff60b053b
commit 1759252071
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/core/buffer.c
View File

@@ -208,6 +208,16 @@ static Janet cfun_buffer_chars(int32_t argc, Janet *argv) {
JanetBuffer *buffer = janet_getbuffer(argv, 0);
for (i = 1; i < argc; i++) {
JanetByteView view = janet_getbytes(argv, i);
if (janet_checktype(argv[i], JANET_BUFFER)) {
JanetBuffer *other = janet_getbuffer(argv, i);
if (buffer == other) {
JanetBuffer *tmp = janet_buffer(buffer->count);
janet_buffer_setcount(tmp, buffer->count);
memcpy(tmp->data, buffer->data, buffer->count);
view.bytes = tmp->data;
view.len = tmp->count;
}
}
janet_buffer_push_bytes(buffer, view.bytes, view.len);
}
return argv[0];