Fix OOB read (2) in OpenDDLParser::parsePrimitiveDataType (#6316)

Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
This commit is contained in:
Kyungjoon Ko
2025-08-14 03:51:07 -07:00
committed by GitHub
parent e3f9cf5564
commit 3a0ee8792f

View File

@@ -595,6 +595,9 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
} else {
in += prim_len;
}
if (in >= end) {
return in;
}
bool ok(true);
if (*in == Grammar::OpenArrayToken[0]) {
@@ -602,13 +605,13 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
++in;
char *start(in);
while (in != end) {
++in;
if (*in == Grammar::CloseArrayToken[0]) {
len = ::atoi(start);
ok = true;
++in;
break;
}
++in;
}
} else {
len = 1;