Fossil SCM
Fixed an array-bounds access violation in Th_SubCommand. Problem reported via the mailing list.
Commit
05ec4ed3c426a0d8ade85fbeda7937f026501426
Parent
1d70fb470117713…
1 file changed
+12
-7
+12
-7
| --- src/th_lang.c | ||
| +++ src/th_lang.c | ||
| @@ -887,19 +887,24 @@ | ||
| 887 | 887 | int argc, |
| 888 | 888 | const char **argv, |
| 889 | 889 | int *argl, |
| 890 | 890 | Th_SubCommand *aSub |
| 891 | 891 | ){ |
| 892 | - int i; | |
| 893 | - for(i=0; aSub[i].zName; i++){ | |
| 894 | - char *zName = (char *)aSub[i].zName; | |
| 895 | - if( th_strlen(zName)==argl[1] && 0==memcmp(zName, argv[1], argl[1]) ){ | |
| 896 | - return aSub[i].xProc(interp, ctx, argc, argv, argl); | |
| 892 | + if( argc>1 ){ | |
| 893 | + int i; | |
| 894 | + for(i=0; aSub[i].zName; i++){ | |
| 895 | + char *zName = (char *)aSub[i].zName; | |
| 896 | + if( th_strlen(zName)==argl[1] && 0==memcmp(zName, argv[1], argl[1]) ){ | |
| 897 | + return aSub[i].xProc(interp, ctx, argc, argv, argl); | |
| 898 | + } | |
| 897 | 899 | } |
| 898 | 900 | } |
| 899 | - | |
| 900 | - Th_ErrorMessage(interp, "Expected sub-command, got:", argv[1], argl[1]); | |
| 901 | + if(argc<2){ | |
| 902 | + Th_ErrorMessage(interp, "Expected sub-command", 0, 0); | |
| 903 | + }else{ | |
| 904 | + Th_ErrorMessage(interp, "Expected sub-command, got:", argv[1], argl[1]); | |
| 905 | + } | |
| 901 | 906 | return TH_ERROR; |
| 902 | 907 | } |
| 903 | 908 | |
| 904 | 909 | /* |
| 905 | 910 | ** TH Syntax: |
| 906 | 911 |
| --- src/th_lang.c | |
| +++ src/th_lang.c | |
| @@ -887,19 +887,24 @@ | |
| 887 | int argc, |
| 888 | const char **argv, |
| 889 | int *argl, |
| 890 | Th_SubCommand *aSub |
| 891 | ){ |
| 892 | int i; |
| 893 | for(i=0; aSub[i].zName; i++){ |
| 894 | char *zName = (char *)aSub[i].zName; |
| 895 | if( th_strlen(zName)==argl[1] && 0==memcmp(zName, argv[1], argl[1]) ){ |
| 896 | return aSub[i].xProc(interp, ctx, argc, argv, argl); |
| 897 | } |
| 898 | } |
| 899 | |
| 900 | Th_ErrorMessage(interp, "Expected sub-command, got:", argv[1], argl[1]); |
| 901 | return TH_ERROR; |
| 902 | } |
| 903 | |
| 904 | /* |
| 905 | ** TH Syntax: |
| 906 |
| --- src/th_lang.c | |
| +++ src/th_lang.c | |
| @@ -887,19 +887,24 @@ | |
| 887 | int argc, |
| 888 | const char **argv, |
| 889 | int *argl, |
| 890 | Th_SubCommand *aSub |
| 891 | ){ |
| 892 | if( argc>1 ){ |
| 893 | int i; |
| 894 | for(i=0; aSub[i].zName; i++){ |
| 895 | char *zName = (char *)aSub[i].zName; |
| 896 | if( th_strlen(zName)==argl[1] && 0==memcmp(zName, argv[1], argl[1]) ){ |
| 897 | return aSub[i].xProc(interp, ctx, argc, argv, argl); |
| 898 | } |
| 899 | } |
| 900 | } |
| 901 | if(argc<2){ |
| 902 | Th_ErrorMessage(interp, "Expected sub-command", 0, 0); |
| 903 | }else{ |
| 904 | Th_ErrorMessage(interp, "Expected sub-command, got:", argv[1], argl[1]); |
| 905 | } |
| 906 | return TH_ERROR; |
| 907 | } |
| 908 | |
| 909 | /* |
| 910 | ** TH Syntax: |
| 911 |