mirrors/janet
1
0
Fork 0
mirror of https://github.com/janet-lang/janet synced 2024-12-27 17:00:27 +00:00
Code Issues 1 Releases Wiki Activity

Merge pull request #826 from rick2600/fix-uaf-cfun_array_concat

Browse Source 
fix issue #825
This commit is contained in:
Calvin Rose 2021-10-06 17:48:27 -05:00 committed by GitHub
commit e48ca1a03f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/core/array.c
View File

@ -241,6 +241,11 @@ JANET_CORE_FN(cfun_array_concat,
int32_t j, len = 0; int32_t j, len = 0;
const Janet *vals = NULL; const Janet *vals = NULL;
janet_indexed_view(argv[i], &vals, &len); janet_indexed_view(argv[i], &vals, &len);
if (array->data == vals) {
int32_t newcount = array->count + len;
janet_array_ensure(array, newcount, 2);
janet_indexed_view(argv[i], &vals, &len);
}
for (j = 0; j < len; j++) for (j = 0; j < len; j++)
janet_array_push(array, vals[j]); janet_array_push(array, vals[j]);
} }