[DragonFlyBSD - Bug #3426] flex: unchecked int overflow in sko_push()

[sigttou]

Issue #3426 has been updated by sigttou.

File 0001-flex-Guard-against-int-overflow-in-sko_push.patch added

Sadly flex hasn't had a new release since 2017. `sko_push()` was deleted in 2020, as part of a large refactor, which is still unreleased.

I kept the minimal guard, and recorded the change in `crontrib/flex/README.DRAGONFLY`.

----------------------------------------
Bug #3426: flex: unchecked int overflow in sko_push()
http://bugs.dragonflybsd.org/issues/3426#change-14705

* Author: sigttou
* Status: New
* Priority: Normal
* Assignee: liweitianux
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-26
----------------------------------------
sko_push() doubles sko_sz, an int, without checking for overflow, then casts
it to size_t for realloc(). On overflow the cast gives a bogus size.

Guard the doubling against INT_MAX / 2, matching the overflow checks flex
already does in allocate_array()/reallocate_array().

---Files--------------------------------
0001-flex-Guard-against-int-overflow-in-sko_push.patch (1.04 KB)
0001-flex-Guard-against-int-overflow-in-sko_push.patch (1.46 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account