-
Notifications
You must be signed in to change notification settings - Fork 52
Open
Description
In vcdecoder.cc, there is a check to see if the copy address falls within the decoded buffer:
Line 1194 in 868f459
| if ((decoded_address < 0) || (decoded_address > here_address)) { |
Here, the expression (decoded_address > here_address) should be replaced by (decoded_address >= here_address). Otherwise, if decoded_address == here_address, you'll go into an infinite loop here:
Lines 1221 to 1228 in 868f459
| while (size > (target_bytes_decoded - address)) { | |
| // Recursive copy that extends into the yet-to-be-copied target data | |
| const size_t partial_copy_size = target_bytes_decoded - address; | |
| CopyBytes(&target_segment_ptr[address], partial_copy_size); | |
| target_bytes_decoded += partial_copy_size; | |
| address += partial_copy_size; | |
| size -= partial_copy_size; | |
| } |
This isn't a problem in practice, because VCDiffAddressCache already validates the returned address (correctly, this time):
Line 217 in 868f459
| } else if (decoded_address >= here_address) { |
So the check in vcdecoder.cc should be unnecessary. Still, if it's kept, it should be correct.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels