diff options
| author | Ran Benita <ran234@gmail.com> | 2018-03-10 23:10:47 +0200 |
|---|---|---|
| committer | Ran Benita <ran234@gmail.com> | 2018-07-30 10:35:10 +0300 |
| commit | 1f9d1248c07cda8aaff762429c0dce146de8632a (patch) | |
| tree | 820a0c8e11ea0a0d7993d91f80d72ca7ae9824cf /src/xkbcomp/expr.c | |
| parent | 2cb5c2a3f3a74fb7478648a7811ca2b6e6272311 (diff) | |
| download | xorg-lib-libxkbcommon-1f9d1248c07cda8aaff762429c0dce146de8632a.tar.gz | |
xkbcomp: fix stack overflow when evaluating boolean negation
The expression evaluator would go into an infinite recursion when
evaluating something like this as a boolean: `!True`. Instead of
recursing to just `True` and negating, it recursed to `!True` itself
again.
Bug inherited from xkbcomp.
Caught with the afl fuzzer.
Signed-off-by: Ran Benita <ran234@gmail.com>
Diffstat (limited to 'src/xkbcomp/expr.c')
| -rw-r--r-- | src/xkbcomp/expr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/xkbcomp/expr.c b/src/xkbcomp/expr.c index 3ff3c18..5d43cba 100644 --- a/src/xkbcomp/expr.c +++ b/src/xkbcomp/expr.c @@ -165,7 +165,7 @@ ExprResolveBoolean(struct xkb_context *ctx, const ExprDef *expr, case EXPR_INVERT: case EXPR_NOT: - ok = ExprResolveBoolean(ctx, expr, set_rtrn); + ok = ExprResolveBoolean(ctx, expr->unary.child, set_rtrn); if (ok) *set_rtrn = !*set_rtrn; return ok; |