check for memory overflows in format (very long double, say) obs from Ingo Thon.
This commit is contained in:
parent
3fc4f71bee
commit
a45da5f722
24
C/iopreds.c
24
C/iopreds.c
@ -4826,7 +4826,7 @@ base_dig(Int dig, Int ch)
|
|||||||
static Int
|
static Int
|
||||||
format(volatile Term otail, volatile Term oargs, int sno)
|
format(volatile Term otail, volatile Term oargs, int sno)
|
||||||
{
|
{
|
||||||
char tmp1[256], tmp2[256];
|
char tmp1[256];
|
||||||
int ch;
|
int ch;
|
||||||
int column_boundary;
|
int column_boundary;
|
||||||
Term mytargs[8], *targs;
|
Term mytargs[8], *targs;
|
||||||
@ -5047,14 +5047,28 @@ format(volatile Term otail, volatile Term oargs, int sno)
|
|||||||
tmp1[0] = '%';
|
tmp1[0] = '%';
|
||||||
tmp1[1] = '.';
|
tmp1[1] = '.';
|
||||||
ptr = tmp1+2;
|
ptr = tmp1+2;
|
||||||
|
#if HAVE_SNPRINTF
|
||||||
|
snprintf(ptr,256-5,"%d",repeats);
|
||||||
|
#else
|
||||||
sprintf(ptr,"%d",repeats);
|
sprintf(ptr,"%d",repeats);
|
||||||
|
#endif
|
||||||
while (*ptr) ptr++;
|
while (*ptr) ptr++;
|
||||||
ptr[0] = ch;
|
ptr[0] = ch;
|
||||||
ptr[1] = '\0';
|
ptr[1] = '\0';
|
||||||
sprintf (tmp2, tmp1, fl);
|
{
|
||||||
ptr = tmp2;
|
char *tmp2;
|
||||||
while ((ch = *ptr++) != 0)
|
if (!(tmp2 = Yap_AllocCodeSpace(repeats+10)))
|
||||||
f_putc(sno, ch);
|
goto do_type_int_error;
|
||||||
|
#if HAVE_SNPRINTF
|
||||||
|
snprintf (tmp2, repeats+10, tmp1, fl);
|
||||||
|
#else
|
||||||
|
sprintf (tmp2, tmp1, fl);
|
||||||
|
#endif
|
||||||
|
ptr = tmp2;
|
||||||
|
while ((ch = *ptr++) != 0)
|
||||||
|
f_putc(sno, ch);
|
||||||
|
Yap_FreeCodeSpace(tmp2);
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
case 'd':
|
case 'd':
|
||||||
case 'D':
|
case 'D':
|
||||||
|
Reference in New Issue
Block a user