Skip to content

Commit

Permalink
utf8.c: Postpone pointer subtraction until it turns out to be safe
Browse files Browse the repository at this point in the history
In Perl_utf8_to_uv_msgs_helper_(),  "curlen = send - s0;" used to be done
earlier in this function, but this subtraction might underflow as
"send >= s0" (that is, "e >= s0") does not necessarily hold true.

Thanks to @mauke and @tonycoz for pointing this out.
  • Loading branch information
t-a-k committed Jan 10, 2025
1 parent 129e8d8 commit dad11fc
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions utf8.c
Original file line number Diff line number Diff line change
Expand Up @@ -1634,7 +1634,6 @@ Perl_utf8_to_uv_msgs_helper_(const U8 * const s0,
* than a single character */
const U8 * send = e;

Size_t curlen = send - s0;
U32 possible_problems; /* A bit is set here for each potential problem
found as we go along */
UV uv = 0;
Expand Down Expand Up @@ -1723,11 +1722,13 @@ Perl_utf8_to_uv_msgs_helper_(const U8 * const s0,
* allowed one, we could allow in something that shouldn't have been.
*/

if (UNLIKELY(curlen <= 0)) {
Size_t curlen;
if (UNLIKELY(s0 >= send)) {
possible_problems |= UTF8_GOT_EMPTY;
curlen = 0;
goto ready_to_handle_errors;
}
curlen = send - s0;

/* We now know we can examine the first byte of the input */
expectlen = UTF8SKIP(s0);
Expand Down

0 comments on commit dad11fc

Please sign in to comment.