diff options
| author | Jan Sturm <jansturm92@googlemail.com> | 2024-10-29 19:26:19 +0100 |
|---|---|---|
| committer | Damien George <damien@micropython.org> | 2024-11-18 23:27:13 +1100 |
| commit | a7d3bc23085fdc4dfe9bf644daf7fa6f2d5559df (patch) | |
| tree | 093f069a34a3fd2858e620355957c0764ae06933 | |
| parent | c0afff8f22ccb84ab46b01ebcd5e1e49803a71cb (diff) | |
| download | micropython-a7d3bc23085fdc4dfe9bf644daf7fa6f2d5559df.tar.gz micropython-a7d3bc23085fdc4dfe9bf644daf7fa6f2d5559df.zip | |
py/objdeque: Fix buffer overflow in deque_subscr.
In `deque_subscr()`, if `index_val` equals `self->alloc`, the index
correction `index_val -= self->alloc` does not execute, leading to an
out-of-bounds access in `self->items[index_val]`.
The fix in this commit ensures that the index correction is applied
whenever `index_val >= self->alloc`, preventing access beyond the allocated
buffer size.
Signed-off-by: Jan Sturm <jansturm92@googlemail.com>
| -rw-r--r-- | py/objdeque.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/py/objdeque.c b/py/objdeque.c index 2ad771284d..22c380a05a 100644 --- a/py/objdeque.c +++ b/py/objdeque.c @@ -208,7 +208,7 @@ static mp_obj_t deque_subscr(mp_obj_t self_in, mp_obj_t index, mp_obj_t value) { size_t offset = mp_get_index(self->base.type, deque_len(self), index, false); size_t index_val = self->i_get + offset; - if (index_val > self->alloc) { + if (index_val >= self->alloc) { index_val -= self->alloc; } |