luanti-org/luanti
1
0
Fork 0
mirror of https://github.com/luanti-org/luanti.git synced 2025-11-04 09:15:29 +01:00
Code Activity

Fix irrString use-after-free with char-like assignment (operator=)

Browse Source
This commit is contained in:
swagtoy
2024-10-04 04:45:09 -04:00
committed by GitHub
parent 84b9321977
commit 05cbd84ae0
1 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
irr/include/irrString.h
View File

@@ -173,13 +173,24 @@ public:
return *this;
}
// no longer allowed!
_IRR_DEBUG_BREAK_IF((void *)c == (void *)c_str());
if constexpr (sizeof(T) != sizeof(B)) {
_IRR_DEBUG_BREAK_IF(
(uintptr_t)c >= (uintptr_t)(str.data()) &&
(uintptr_t)c < (uintptr_t)(str.data() + str.size()));
}
if ((void *)c == (void *)c_str())
return *this;
u32 len = calclen(c);
str.resize(len);
// In case `c` is a pointer to our own buffer, we may not resize first
// or it can become invalid.
if (len > str.size())
str.resize(len);
for (u32 l = 0; l < len; ++l)
str[l] = (T)c[l];
str[l] = static_cast<T>(c[l]);
if (len < str.size())
str.resize(len);
return *this;
}