Skip to content

sCalc: fix out-of-bounds read in lrc() on an empty operand #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
physwkim wants to merge 1 commit into
base: master
Choose a base branch
from
Open

sCalc: fix out-of-bounds read in lrc() on an empty operand #39

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions calcApp/src/sCalcPerform.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,10 +241,14 @@ int hex(char c) {

int lrc(char *output, char *rawInput)
{
int i;
int i, len;
unsigned int lrc;

for (i=0, lrc=0; i<strlen(rawInput)-1; i+=2) {
/* strlen() is size_t; for an empty operand strlen(rawInput)-1 would
* wrap to SIZE_MAX and the loop would read out of bounds. Compare
* against a signed length so an empty string yields an empty loop. */
len = (int)strlen(rawInput);
for (i=0, lrc=0; i+1<len; i+=2) {
lrc += hex(rawInput[i])*0x10 + hex(rawInput[i+1]);
if (sCalcPerformDebug>=20) printf("lrc: adding %d\n", rawInput[i]*0x10 + rawInput[i+1]);
}
Expand Down
8 changes: 7 additions & 1 deletion tests/scalcTest.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ MAIN(scalcTest)
double args[12] = {A, B, C, D, E, F, G, H, I, J, K, L};
const char* sargs[12] = {AA, BB, CC, DD, EE, FF, GG, HH, II, JJ, KK, LL};

testPlan(143);
testPlan(145);

testValExpr("finite(1)", args, sargs, 1);
testValExpr("isnan(1)", args, sargs, 0);
Expand Down Expand Up @@ -288,6 +288,12 @@ MAIN(scalcTest)
/* String subtract-first and subtract-last */
testSValExpr("'abca'-|'a'", args, sargs, "bca");
testSValExpr("'abca'|-'a'", args, sargs, "abc");

/* LRC on an empty operand: strlen(rawInput)-1 must not wrap size_t and
* read out of bounds. Empty -> empty loop -> lrc 0 -> "00".
* The documented AMODBUS example "F7031389000A" has LRC 0x60. */
testSValExpr("LRC('')", args, sargs, "00");
testSValExpr("LRC('F7031389000A')", args, sargs, "60");

/* UNTIL loops */
testValExpr("UNTIL(1)", args, sargs, 1.0);
Expand Down