diff options
| author | Jim Meyering <jim@meyering.net> | 2011-10-23 16:04:11 -0700 |
|---|---|---|
| committer | Father Chrysostomos <sprout@cpan.org> | 2011-10-23 16:47:53 -0700 |
| commit | 26e1303d691c34af15e9332d5ba72c53be9a4263 (patch) | |
| tree | f9b7b6f5126aafffea8ce96c17cf5f7ac3938d6b /proto.h | |
| parent | dd8fc02804485f0ffdfd876c119b4f9500c7be86 (diff) | |
| download | perl-26e1303d691c34af15e9332d5ba72c53be9a4263.tar.gz | |
don't segfault given string repeat count larger than 2^31
E.g., this overflows INT_MAX and overruns heap memory:
$ perl -le 'print "v"x(2**31+1)'
[Exit 139 (SEGV)]
(Perl_repeatcpy): Use the same type for "count" as our sole
callers in pp.c: IV (long), not I32 (int). Otherwise, passing
the wider value to a narrower "I32 count"
Diffstat (limited to 'proto.h')
| -rw-r--r-- | proto.h | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -3244,7 +3244,7 @@ PERL_CALLCONV void Perl_regprop(pTHX_ const regexp *prog, SV* sv, const regnode* #define PERL_ARGS_ASSERT_REGPROP \ assert(sv); assert(o) -PERL_CALLCONV void Perl_repeatcpy(char* to, const char* from, I32 len, I32 count) +PERL_CALLCONV void Perl_repeatcpy(char* to, const char* from, I32 len, IV count) __attribute__nonnull__(1) __attribute__nonnull__(2); #define PERL_ARGS_ASSERT_REPEATCPY \ |