Merge pull request #2874 from cremno/fix-parser-oob-write

Coverity: fix oob write by actually truncating buffer

Merge pull request #2874 from cremno/fix-parser-oob-write
Coverity: fix oob write by actually truncating buffer
1dbb2b74 · Yukihiro "Matz" Matsumoto · b071dcd4 · 24583a7a · 1dbb2b74
Commit 1dbb2b74 authored Jul 03, 2015 by Yukihiro "Matz" Matsumoto
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 2 deletions

mrbgems/mruby-compiler/core/parse.y mrbgems/mruby-compiler/core/parse.y +5 -2

No files found.
--- a/mrbgems/mruby-compiler/core/parse.y
+++ b/mrbgems/mruby-compiler/core/parse.y
@@ -3604,10 +3604,13 @@ toklast(parser_state *p)
 static void
 tokfix(parser_state *p)
 {
-  if (p->bidx >= MRB_PARSER_BUF_SIZE) {
+  int i = p->bidx, imax = MRB_PARSER_BUF_SIZE - 1;
+
+  if (i > imax) {
+    i = imax;
    yyerror(p, "string too long (truncated)");
  }
-  p->buf[p->bidx] = '\0';
+  p->buf[i] = '\0';
 }

 static const char*