[ pure-data-Patches-1930733 ] 0.41-4: prevent buffer overrun in m_class.c - Pd-dev

26 May 2008

Patches item #1930733, was opened at 2008-04-01 01:02
Message generated for change (Settings changed) made by xovo
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=478072&aid=1930733...
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: puredata
Group: bugfix
...
Status: Open
Resolution: Invalid
Priority: 7
Private: No
Submitted By: Thomas Grill (xovo)
Assigned to: Thomas Grill (xovo)
Summary: 0.41-4: prevent buffer overrun in m_class.c
Initial Comment:
the array only has MAXPDARG elements.......

--- m_class.ori.c	2008-04-01 03:00:09.000000000 +0200
+++ m_class.c	2008-04-01 03:00:12.000000000 +0200
@@ -763,7 +763,7 @@
     va_start(ap, fmt);
     while (1)
     {
-        if (nargs > MAXPDARG)
+        if (nargs >= MAXPDARG)
         {
             pd_error(x, "pd_vmess: only %d allowed", MAXPDARG);
             break;
----------------------------------------------------------------------
...
Comment By: Thomas Grill (xovo)
Date: 2008-05-26 07:17
Message:
Logged In: YES 
user_id=350252
Originator: YES
Is the arg array too small then and must have MAXPDARGS+1 elements
instead?
In the loop, the "at" pointer subsequently points to the elements of
"arg". If the switch statement is reached with a value of "nargs ==
MAXPDARG", then "arg" points to a position outside the array.
----------------------------------------------------------------------
Comment By: Hans-Christoph Steiner (eighthave)
Date: 2008-05-25 21:52
Message:
Logged In: YES 
user_id=27104
Originator: NO
This patch causes this message when clicking on abstractions and
subpatches in run mode:
error: pd_vmess: only 5 allowed
... you might be able to track this down from the Find menu.
I think this patch might be invalid since nargs is only used to send to
typedmess() as argc, in which case 5 is the appropriate value.
----------------------------------------------------------------------
Comment By: Hans-Christoph Steiner (eighthave)
Date: 2008-04-15 23:42
Message:
Logged In: YES 
user_id=27104
Originator: NO
checked into branches/pd-extended/0.40
----------------------------------------------------------------------
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=478072&aid=1930733...

    