Fix OOB read (2) in OpenDDLParser::parsePrimitiveDataType (#6316)
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
This commit is contained in:
@@ -595,6 +595,9 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
|
||||
} else {
|
||||
in += prim_len;
|
||||
}
|
||||
if (in >= end) {
|
||||
return in;
|
||||
}
|
||||
|
||||
bool ok(true);
|
||||
if (*in == Grammar::OpenArrayToken[0]) {
|
||||
@@ -602,13 +605,13 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
|
||||
++in;
|
||||
char *start(in);
|
||||
while (in != end) {
|
||||
++in;
|
||||
if (*in == Grammar::CloseArrayToken[0]) {
|
||||
len = ::atoi(start);
|
||||
ok = true;
|
||||
++in;
|
||||
break;
|
||||
}
|
||||
++in;
|
||||
}
|
||||
} else {
|
||||
len = 1;
|
||||
|
||||
Reference in New Issue
Block a user