Skip to content

Commit f82a1ea

Browse files
committed
moductypes: Defensiveness in uctypes_struct_agg_size().
Eliminates read-beyond-end when calling uctypes_struct_agg_size() on the length 1 tuple (uctypes.ARRAY ,). Signed-off-by: Duncan Lowther <Duncan.Lowther@glasgow.ac.uk>
1 parent ed463ed commit f82a1ea

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

extmod/moductypes.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,9 @@ static mp_uint_t uctypes_struct_agg_size(mp_obj_tuple_t *t, int layout_type, mp_
180180
}
181181
return sizeof(void *);
182182
case ARRAY: {
183+
if (t->len < 2) {
184+
syntax_error();
185+
}
183186
mp_int_t arr_sz = MP_OBJ_SMALL_INT_VALUE(t->items[1]);
184187
uint val_type = GET_TYPE(arr_sz, VAL_TYPE_BITS);
185188
arr_sz &= VALUE_MASK(VAL_TYPE_BITS);

0 commit comments

Comments
 (0)