diff options
| author | Jarkko Hietaniemi <jhi@iki.fi> | 2014-04-21 21:43:12 -0400 |
|---|---|---|
| committer | Tony Cook <tony@develop-help.com> | 2014-04-30 09:58:53 +1000 |
| commit | adc2d0c9de764f1cb892860df8ecc93dc8909b39 (patch) | |
| tree | ecfc5cba6fc7d278683dd9d8d8cd2b6970a44471 /regnodes.h | |
| parent | 2a600bb8f7c0d6b36cb37c899b6c9e82537ec394 (diff) | |
| download | perl-adc2d0c9de764f1cb892860df8ecc93dc8909b39.tar.gz | |
Fix for Coverity perl5 CID 29034: Out-of-bounds read (OVERRUN) overrun-local: Overrunning array PL_reg_intflags name of 14 8-byte elements at element index 31 (byte offset 248) using index bit (which evaluates to 31).
Needed compile-time limits for the PL_reg_intflags_name so that the
bit loop doesn't waltz off past the array. Could not use C_ARRAY_LENGTH
because the size of name array is not visible during compile time
(only const char*[] is), so modified regcomp.pl to generate the size,
made it visible only under DEBUGGING. Did extflags analogously
even though its size currently exactly 32 already. The sizeof(flags)*8
is extra paranoia for ILP64.
Diffstat (limited to 'regnodes.h')
| -rw-r--r-- | regnodes.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/regnodes.h b/regnodes.h index 4f4ff9e192..43ec681967 100644 --- a/regnodes.h +++ b/regnodes.h @@ -676,6 +676,10 @@ EXTCONST char * const PL_reg_extflags_name[] = { }; #endif /* DOINIT */ +#ifdef DEBUGGING +# define REG_EXTFLAGS_NAME_SIZE 32 +#endif + /* PL_reg_intflags_name[] - Opcode/state names in string form, for debugging */ #ifndef DOINIT @@ -699,6 +703,10 @@ EXTCONST char * const PL_reg_intflags_name[] = { }; #endif /* DOINIT */ +#ifdef DEBUGGING +# define REG_INTFLAGS_NAME_SIZE 14 +#endif + /* The following have no fixed length. U8 so we can do strchr() on it. */ #define REGNODE_VARIES(node) (PL_varies_bitmask[(node) >> 3] & (1 << ((node) & 7))) |