Browse code

bb12221: Fix for subtle type-mismatch that could result in an infinite loop with a large number of sigs.

Micah Snyder (micasnyd) authored on 2018/11/17 04:50:48
Showing 1 changed files
... ...
@@ -93,7 +93,8 @@ static inline int insert_list(struct cli_matcher *root, struct cli_ac_patt *patt
93 93
     struct cli_ac_patt *php;
94 94
     struct cli_ac_special *a1, *a2;
95 95
     struct cli_alt_node *b1, *b2;
96
-    uint8_t i, j, match;
96
+    int match;
97
+    uint16_t i, j;
97 98
 
98 99
     new = (struct cli_ac_list *)mpool_calloc(root->mempool, 1, sizeof(struct cli_ac_list));
99 100
     if (!new) {
... ...
@@ -309,7 +310,7 @@ int cli_ac_addpatt(struct cli_matcher *root, struct cli_ac_patt *pattern)
309 309
 {
310 310
     struct cli_ac_patt **newtable;
311 311
     uint16_t len = MIN(root->ac_maxdepth, pattern->length[0]);
312
-    uint8_t i;
312
+    uint16_t i;
313 313
 
314 314
     for(i = 0; i < len; i++) {
315 315
         if(pattern->pattern[i] & CLI_MATCH_WILDCARD) {
... ...
@@ -1769,7 +1770,7 @@ int cli_ac_scanbuff(
1769 1769
 
1770 1770
                             found = 0;
1771 1771
                             if(pt->partno != 1) {
1772
-                                for(j = 1; j <= CLI_DEFAULT_AC_TRACKLEN + 1 && offmatrix[pt->partno - 2][j] != (uint32_t)-1; j++) {
1772
+                                for(j = 1; (j <= CLI_DEFAULT_AC_TRACKLEN + 1) && (offmatrix[pt->partno - 2][j] != (uint32_t)-1); j++) {
1773 1773
                                     found = j;
1774 1774
                                     if(realoff < offmatrix[pt->partno - 2][j])
1775 1775
                                         found = 0;
... ...
@@ -1954,10 +1955,10 @@ static int qcompare_fstr(const void *arg, const void *a, const void *b)
1954 1954
 }
1955 1955
 
1956 1956
 /* returns if level of nesting, end set to MATCHING paren, start AFTER staring paren */
1957
-inline static int find_paren_end(char *hexstr, char **end)
1957
+inline static size_t find_paren_end(char *hexstr, char **end)
1958 1958
 {
1959
-    unsigned long i;
1960
-    int nest = 0, level = 0;
1959
+    size_t i;
1960
+    size_t nest = 0, level = 0;
1961 1961
 
1962 1962
     *end = NULL;
1963 1963
     for (i = 0; i < strlen(hexstr); i++) {
... ...
@@ -2543,7 +2544,7 @@ int cli_ac_addsig(struct cli_matcher *root, const char *virname, const char *hex
2543 2543
 
2544 2544
     if(strchr(hexsig, '(')) {
2545 2545
         char *hexnew, *start;
2546
-        uint8_t nest;
2546
+        size_t nest;
2547 2547
         size_t hexnewsz;
2548 2548
 
2549 2549
         if(hex) {