lex: Fix buffer overrun parsing overlong hexadecimal constants.
In previous code, if hexit == 0, then the boundary for 'out' is
not checked. This patch fixes it.
Reported-at:
@@ -332,14 +332,16 @@ lex_parse_hex_integer(const char *start, size_t len, struct lex_token *token)
if (hexit < 0) {
lex_error(token, "Invalid syntax in hexadecimal constant.");
return;
- }
- if (hexit && i / 2 >= sizeof token->value.u8) {
+ } else if (hexit) {
+ /* Check within loop to ignore any number of leading zeros. */
+ if (i / 2 >= sizeof token->value.u8) {
lex_error(token, "Hexadecimal constant requires more than "
"%"PRIuSIZE" bits.", 8 * sizeof token->value.u8);
return;
}
out[-(i / 2)] |= i % 2 ? hexit << 4 : hexit;
}
+ }
token->format = LEX_F_HEXADECIMAL;
}
