[DragonFlyBSD - Bug #3426] (Resolved) flex: unchecked int overflow in sko_push()

[liweitianux]

Issue #3426 has been updated by liweitianux.

Status changed from New to Resolved

Merged into both master and 6.4 branches. Thank you.

----------------------------------------
Bug #3426: flex: unchecked int overflow in sko_push()
http://bugs.dragonflybsd.org/issues/3426#change-14709

* Author: sigttou
* Status: Resolved
* Priority: Normal
* Assignee: liweitianux
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-26
----------------------------------------
sko_push() doubles sko_sz, an int, without checking for overflow, then casts
it to size_t for realloc(). On overflow the cast gives a bogus size.

Guard the doubling against INT_MAX / 2, matching the overflow checks flex
already does in allocate_array()/reallocate_array().

---Files--------------------------------
0001-flex-Guard-against-int-overflow-in-sko_push.patch (1.04 KB)
0001-flex-Guard-against-int-overflow-in-sko_push.patch (1.46 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account