Skip to content

Commit a84be41

Browse files
author
hongjinghao
committed
paramlen has heap memory of length nparam+1. The value of variable i may be greater than nparam+1, causing heap memory overflow. Therefore, i and nparam+1 needs to be determined in the loop. fix:https://bugzilla.nasm.us/show_bug.cgi?id=3392857#c1
1 parent a916e41 commit a84be41

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

asm/preproc.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -6817,7 +6817,7 @@ static int expand_mmacro(Token * tline)
68176817
*/
68186818
nasm_newn(paramlen, nparam+1);
68196819

6820-
for (i = 1; (t = params[i]); i++) {
6820+
for (i = 1; (t = params[i] && i < nparam+1); i++) {
68216821
bool braced = false;
68226822
int brace = 0;
68236823
int white = 0;

0 commit comments

Comments
 (0)