Changeset 2770 for trunk/src/kmk/function.c

Timestamp:

Feb 1, 2015, 6:12:37 PM (10 years ago)

Author:

bird

Message:

string expansion debugged and enabled. fixed access-after-alloc bug in func_sort and could lead to heap corruption.

File:

• trunk/src/kmk/function.c (modified) (4 diffs)

trunk/src/kmk/function.c

@@ -1360 +1360 @@
       var->value[len] = '\0';
       var->value_length = len;
+      VARIABLE_CHANGED (var);
 
       variable_expand_string_2 (o, body, body_len, &o);
@@ -1754 +1755 @@
   while ((p = find_next_token (&t, &len)) != 0)
     {
-      ++t;
+      if (*t != '\0') /* bird: Fixes access beyond end of string and overflowing words array. */
+        ++t;
       p[len] = '\0';
       words[wordi++] = p;
@@ -2160 +2162 @@
               v->value_length = dst - v->value;
             }
+
+          VARIABLE_CHANGED (v);
 
 # ifdef CONFIG_WITH_COMPILER
@@ -4648 +4652 @@
               stack_var->value_length = lastitem - stack_var->value;
 #endif
+              VARIABLE_CHANGED (stack_var);
             }
         }