Skip to content

Buffer overflow in function "microrl_get_complite" #38

@pouya13

Description

@pouya13

Hi,

There is a buffer overflow for array "tkn_arr".
In line 501, if the variable status<0, then the buffer overflow will happen in line 503. This can fix it:

     int status = split(pThis, pThis->cursor, tkn_arr);
+    if (status < 0) {
+        return;
+    }

-    if (pThis->cmdline[pThis->cursor-1] == '\0')
-        tkn_arr[status++] = "";
+    if (pThis->cursor > 0 && pThis->cmdline[pThis->cursor - 1] == '\0') {
+        if (status < _COMMAND_TOKEN_NMB) {
+            tkn_arr[status++] = "";
+        }
+    }

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions