[DragonFlyBSD - Bug #3426] (New) flex: unchecked int overflow in sko_push()

[sigttou]

Issue #3426 has been reported by sigttou.

----------------------------------------
Bug #3426: flex: unchecked int overflow in sko_push()
http://bugs.dragonflybsd.org/issues/3426

* Author: sigttou
* Status: New
* Priority: Normal
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-26
----------------------------------------
sko_push() doubles sko_sz, an int, without checking for overflow, then casts
it to size_t for realloc(). On overflow the cast gives a bogus size.

Guard the doubling against INT_MAX / 2, matching the overflow checks flex
already does in allocate_array()/reallocate_array().

---Files--------------------------------
0001-flex-Guard-against-int-overflow-in-sko_push.patch (1.04 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account