summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLi Qiang <liq3ea@gmail.com>2017-01-10 03:56:31 -0500
committerMarek Olšák <marek.olsak@amd.com>2017-01-11 12:40:38 +0100
commit6205c533030687c9680f5175e8158060c6e24221 (patch)
tree57b8f0eecd63aade93765b2945dd91de5f0e9f6e
parent2c0d849e2d2990c0122dfb161132558d971e77db (diff)
gallium/tgsi: fix overflow in parse property
In parse_identifier, it doesn't stop copying '*pcur' untill encounter the NULL. As the 'ret' has a fixed-size buffer, if the '*pcur' has a long string, there will be a buffer overflow. This patch avoid this. Signed-off-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Marek Olšák <marek.olsak@amd.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-rw-r--r--src/gallium/auxiliary/tgsi/tgsi_text.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/src/gallium/auxiliary/tgsi/tgsi_text.c b/src/gallium/auxiliary/tgsi/tgsi_text.c
index 1b4f5940460..308e6b52627 100644
--- a/src/gallium/auxiliary/tgsi/tgsi_text.c
+++ b/src/gallium/auxiliary/tgsi/tgsi_text.c
@@ -208,14 +208,17 @@ static boolean parse_int( const char **pcur, int *val )
return FALSE;
}
-static boolean parse_identifier( const char **pcur, char *ret )
+static boolean parse_identifier( const char **pcur, char *ret, size_t len )
{
const char *cur = *pcur;
int i = 0;
if (is_alpha_underscore( cur )) {
ret[i++] = *cur++;
- while (is_alpha_underscore( cur ) || is_digit( cur ))
+ while (is_alpha_underscore( cur ) || is_digit( cur )) {
+ if (i == len - 1)
+ return FALSE;
ret[i++] = *cur++;
+ }
ret[i++] = '\0';
*pcur = cur;
return TRUE;
@@ -1787,7 +1790,7 @@ static boolean parse_property( struct translate_ctx *ctx )
report_error( ctx, "Syntax error" );
return FALSE;
}
- if (!parse_identifier( &ctx->cur, id )) {
+ if (!parse_identifier( &ctx->cur, id, sizeof(id) )) {
report_error( ctx, "Syntax error" );
return FALSE;
}