MonetDB: default - Protect against buffer overflow

[mk]

Changeset: 4cef09f7b667 for MonetDB
URL: http://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=4cef09f7b667
Modified Files:
        MonetDB5/src/mal/mal_instruction.mx
Branch: default
Log Message:

Protect against buffer overflow
by increasing the margin to bail out.


diffs (43 lines):

diff -r 937f0f1eca04 -r 4cef09f7b667 MonetDB5/src/mal/mal_instruction.mx
--- a/MonetDB5/src/mal/mal_instruction.mx       Sun Oct 03 20:12:42 2010 +0200
+++ b/MonetDB5/src/mal/mal_instruction.mx       Sun Oct 03 20:14:38 2010 +0200
@@ -2346,13 +2346,13 @@
 str
 instructionCall(MalBlkPtr mb, InstrPtr p, str s, str base, size_t len)
 {
-       int i, closing=0;
+       int i, closing=0, margin = 2 * PATHLENGTH;
        str tpe;
        if (p->retc > 1){
                *s++ = '(';
                *s=0;
        }
-       for (i = 0; i <= p->argc; i++) {
+       for (i = 0; i <= p->argc && s< base + len - margin; i++) {
                if (i== p->retc){
                        if (i>1 && p->retc > 1){
                                *s++ = ')';
@@ -2380,7 +2380,7 @@
                                nme = nmebuf;
                        } else
                                nme = getArgName(mb, p, i);
-                       snprintf(s, (len-(s-base)), "%s:%s", (nme ? nme : 
"nil"), tpe);
+                       snprintf(s, (len- margin-(s-base)), "%s:%s", (nme ? nme 
: "nil"), tpe);
                        advance(s,base,len);
                        if (i != p->retc-1 && i< p->argc-1)
                                sprintf(s, ", ");
@@ -2912,8 +2912,13 @@
 printSignature(stream *fd, Symbol s, int flg)
 {
        InstrPtr p;
-       str txt = GDKzalloc(MAXLISTING); /* some slack for large blocks */
+       str txt;
 
+       if ( s->def == 0 ){
+               mnstr_printf(fd, "missing definition of %s\n", s->name);
+               return;
+       }
+       txt = GDKzalloc(MAXLISTING); /* some slack for large blocks */
        p = getSignature(s);
        (void) fcnDefinition(s->def, p, txt, flg, txt, MAXLISTING);
        mnstr_printf(fd, "%s\n", txt);
_______________________________________________
Checkin-list mailing list
Checkin-list@monetdb.org
http://mail.monetdb.org/mailman/listinfo/checkin-list