Skip to content

Commit 5729ae0

Browse files
committed
fix: heap buffer overflow in acmp pm
1 parent e5d00df commit 5729ae0

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

src/utils/acmp.cc

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -387,17 +387,18 @@ if (parser->is_active != 0) return -1;
387387
child->pattern = (char *)"";
388388
child->letter = letter;
389389
child->depth = i;
390-
child->text = (char *)calloc(1, strlen(pattern) + 2);
390+
child->text = (char *)calloc(1, length + 2);
391391
/* ENH: Check alloc succeded */
392392
for (j = 0; j <= i; j++) child->text[j] = pattern[j];
393393
}
394394
if (i == length - 1) {
395395
if (child->is_last == 0) {
396396
parser->dict_count++;
397397
child->is_last = 1;
398-
child->pattern = (char *)calloc(1, strlen(pattern) + 2);
398+
child->pattern = (char *)calloc(1, length + 2);
399399
/* ENH: Check alloc succeded */
400-
strcpy(child->pattern, pattern);
400+
memcpy(child->pattern, pattern, length);
401+
child->pattern[length] = '\0';
401402
}
402403
child->callback = callback;
403404
child->callback_data = data;

0 commit comments

Comments
 (0)