haskal
/
kicad
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix buffer overflow in dumpNode 

The formatted string buffer doesn't need to be used, so we bypass it
with string concat
This commit is contained in:
Seth Hillbrand 2020-07-18 13:33:23 -07:00
parent 2d0e3b7e0d
commit a253c53fe7
1 changed files with 18 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
common/libeval_compiler/libeval_compiler.cpp
View File

@ -518,8 +518,7 @@ void dumpNode( std::string& buf, TREE_NODE* tok, int depth = 0 )
if( tok->op & TR_OP_BINARY_MASK ) if( tok->op & TR_OP_BINARY_MASK )
{ {
sprintf( str, "%s", (const char*) formatOpName( tok->op ).c_str() ); buf += formatOpName( tok->op );
buf += str;
dumpNode( buf, tok->leaf[0], depth + 1 ); dumpNode( buf, tok->leaf[0], depth + 1 );
dumpNode( buf, tok->leaf[1], depth + 1 ); dumpNode( buf, tok->leaf[1], depth + 1 );
} }
@ -527,34 +526,30 @@ void dumpNode( std::string& buf, TREE_NODE* tok, int depth = 0 )
switch( tok->op ) switch( tok->op )
{ {
case TR_NUMBER: case TR_NUMBER:
sprintf( str, "NUMERIC: " ); buf += "NUMERIC: ";
buf += str; buf += formatNode( tok );
sprintf( str, "%s", formatNode( tok ).c_str() );
buf += str;
if( tok->leaf[0] ) if( tok->leaf[0] )
dumpNode( buf, tok->leaf[0], depth + 1 ); dumpNode( buf, tok->leaf[0], depth + 1 );
break; break;
case TR_STRING: case TR_STRING:
sprintf( str, "STRING: " ); buf += "STRING: ";
buf += str; buf += formatNode( tok );
sprintf( str, "%s", formatNode( tok ).c_str() );
buf += str;
break; break;
case TR_IDENTIFIER: case TR_IDENTIFIER:
sprintf( str, "ID: " ); buf += "ID: ";
buf += str; buf += formatNode( tok );
sprintf( str, "%s", formatNode( tok ).c_str() );
buf += str;
break; break;
case TR_STRUCT_REF: case TR_STRUCT_REF:
sprintf( str, "SREF: " ); buf += "SREF: ";
buf += str;
dumpNode( buf, tok->leaf[0], depth + 1 ); dumpNode( buf, tok->leaf[0], depth + 1 );
dumpNode( buf, tok->leaf[1], depth + 1 ); dumpNode( buf, tok->leaf[1], depth + 1 );
break; break;
case TR_OP_FUNC_CALL: case TR_OP_FUNC_CALL:
sprintf( str, "CALL '%s': ", tok->leaf[0]->value.str ); buf += "CALL '";
buf += str; buf += tok->leaf[0]->value.str;
buf += "': ";
dumpNode( buf, tok->leaf[1], depth + 1 ); dumpNode( buf, tok->leaf[1], depth + 1 );
break; break;
case TR_UNIT: case TR_UNIT: