gbdev/rgbds
1
0
Fork 0
mirror of https://github.com/gbdev/rgbds.git synced 2025-11-24 03:52:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overflow when creating patches with long RPN expressions

Browse Source 
The createpatch() function was using a fixed-size buffer. I've changed it
to be dynamically allocated. I saw that the RPN format used in patches is
slightly different from the one used internally in the assembler, so I
added a new member to the Expression struct to track the patch size.

I've also limited the RPN expression length to 1MB. I realized that the
patch RPN expression could potentially be longer than the internal RPN
expression, so the internal expression would need a limit smaller than
UINT32_MAX. I thought 1MB would be a reasonable limit.
This commit is contained in:
dbrotz
2019-06-11 09:35:57 -07:00
parent 54e5bf0f0c
commit 015d2b0830
6 changed files with 91 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/asm/output.c
View File

@@ -10,6 +10,7 @@
* Outputs an objectfile
*/
#include <assert.h>
#include <errno.h>
#include <stdio.h>
#include <stdint.h>
@@ -392,10 +393,15 @@ void createpatch(uint32_t type, struct Expression *expr)
{
struct Patch *pPatch;
uint16_t rpndata;
uint8_t rpnexpr[2048];
uint8_t *rpnexpr;
char tzSym[512];
uint32_t rpnptr = 0, symptr;
rpnexpr = malloc(expr->nRPNPatchSize);
if (rpnexpr == NULL)
fatalerror("No memory for patch RPN expression");
pPatch = allocpatch();
pPatch->nType = type;
strcpy(pPatch->tzFilename, tzCurrentFileName);
@@ -477,11 +483,10 @@ void createpatch(uint32_t type, struct Expression *expr)
}
}
pPatch->pRPN = malloc(rpnptr);
if (pPatch->pRPN != NULL) {
memcpy(pPatch->pRPN, rpnexpr, rpnptr);
pPatch->nRPNSize = rpnptr;
}
assert(rpnptr == expr->nRPNPatchSize);
pPatch->pRPN = rpnexpr;
pPatch->nRPNSize = rpnptr;
}
/*