[DragonFlyBSD - Bug #3426] flex: unchecked int overflow in sko_push()

[liweitianux]

Issue #3426 has been updated by liweitianux.

Assignee set to liweitianux

Thank you for the report and patch.

However, this involves the contributed flex, so the better fix would be to upgrade the `contrib/flex` source if the bug has been fixed by the upstream. See also the `contrib/flex/README.DRAGONFLY`.

It would be great if you could help take a look.

----------------------------------------
Bug #3426: flex: unchecked int overflow in sko_push()
http://bugs.dragonflybsd.org/issues/3426#change-14702

* Author: sigttou
* Status: New
* Priority: Normal
* Assignee: liweitianux
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-26
----------------------------------------
sko_push() doubles sko_sz, an int, without checking for overflow, then casts
it to size_t for realloc(). On overflow the cast gives a bogus size.

Guard the doubling against INT_MAX / 2, matching the overflow checks flex
already does in allocate_array()/reallocate_array().

---Files--------------------------------
0001-flex-Guard-against-int-overflow-in-sko_push.patch (1.04 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account