mirror of
https://github.com/janet-lang/janet
synced 2024-11-05 00:06:16 +00:00
Fix use after free in buffer/push-string.
This commit is contained in:
parent
fff60b053b
commit
1759252071
@ -208,6 +208,16 @@ static Janet cfun_buffer_chars(int32_t argc, Janet *argv) {
|
|||||||
JanetBuffer *buffer = janet_getbuffer(argv, 0);
|
JanetBuffer *buffer = janet_getbuffer(argv, 0);
|
||||||
for (i = 1; i < argc; i++) {
|
for (i = 1; i < argc; i++) {
|
||||||
JanetByteView view = janet_getbytes(argv, i);
|
JanetByteView view = janet_getbytes(argv, i);
|
||||||
|
if (janet_checktype(argv[i], JANET_BUFFER)) {
|
||||||
|
JanetBuffer *other = janet_getbuffer(argv, i);
|
||||||
|
if (buffer == other) {
|
||||||
|
JanetBuffer *tmp = janet_buffer(buffer->count);
|
||||||
|
janet_buffer_setcount(tmp, buffer->count);
|
||||||
|
memcpy(tmp->data, buffer->data, buffer->count);
|
||||||
|
view.bytes = tmp->data;
|
||||||
|
view.len = tmp->count;
|
||||||
|
}
|
||||||
|
}
|
||||||
janet_buffer_push_bytes(buffer, view.bytes, view.len);
|
janet_buffer_push_bytes(buffer, view.bytes, view.len);
|
||||||
}
|
}
|
||||||
return argv[0];
|
return argv[0];
|
||||||
|
@ -170,6 +170,15 @@
|
|||||||
(assert (= 8 (length b3)) "buffer/push-word 3")
|
(assert (= 8 (length b3)) "buffer/push-word 3")
|
||||||
(assert (= "\xFF\xFF\xFF\xFF\0\x11\0\0" (string b3)) "buffer/push-word 4")
|
(assert (= "\xFF\xFF\xFF\xFF\0\x11\0\0" (string b3)) "buffer/push-word 4")
|
||||||
|
|
||||||
|
# Buffer push string
|
||||||
|
|
||||||
|
(def b4 (buffer/new-filled 10 0))
|
||||||
|
(buffer/push-string b4 b4)
|
||||||
|
(assert (= "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" (string b4)) "buffer/push-buffer 1")
|
||||||
|
(def b5 @"123")
|
||||||
|
(buffer/push-string b5 "456" @"789")
|
||||||
|
(assert (= "123456789" (string b5)) "buffer/push-buffer 2")
|
||||||
|
|
||||||
# Peg
|
# Peg
|
||||||
|
|
||||||
(defn check-match
|
(defn check-match
|
||||||
|
Loading…
Reference in New Issue
Block a user