mirrors
/
micropython
mirror of https://github.com/micropython/micropython.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

py/objarray: Fix buffer overflow in case of memory allocation failure. 

If `array.append()` fails with an exception due to heap exhaustion, the
next attempt to grow the buffer will cause a buffer overflow because the
free slot count is increased before performing the allocation, and will
stay as if the allocation succeeded.

Signed-off-by: Yoctopuce <dev@yoctopuce.com>
This commit is contained in:
Yoctopuce 2024-06-13 11:23:57 +02:00 committed by Damien George
parent 9111fa5831
commit 3d93fed0aa
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
py/objarray.c
View File

@ -392,8 +392,9 @@ static mp_obj_t array_append(mp_obj_t self_in, mp_obj_t arg) {
if (self->free == 0) {
size_t item_sz = mp_binary_get_size('@', self->typecode, NULL);
// TODO: alloc policy
self->free = 8;
self->items = m_renew(byte, self->items, item_sz * self->len, item_sz * (self->len + self->free));
size_t add_cnt = 8;
self->items = m_renew(byte, self->items, item_sz * self->len, item_sz * (self->len + add_cnt));
self->free = add_cnt;
mp_seq_clear(self->items, self->len + 1, self->len + self->free, item_sz);
}
mp_binary_set_val_array(self->typecode, self->items, self->len, arg);