diff options
| author | Jan Sturm <jansturm92@googlemail.com> | 2024-10-29 19:26:19 +0100 |
|---|---|---|
| committer | Damien George <damien@micropython.org> | 2024-11-04 11:21:56 +1100 |
| commit | 7e1098befe178e4b93657a4d49e6a354037beec4 (patch) | |
| tree | 41575c9662f3142051a286997eb2ea62b180cf42 /py | |
| parent | 0e490b7c8f32bb72c516985abe67147b9385dc34 (diff) | |
| download | micropython-7e1098befe178e4b93657a4d49e6a354037beec4.tar.gz micropython-7e1098befe178e4b93657a4d49e6a354037beec4.zip | |
py/objdeque: Fix buffer overflow in deque_subscr.
In `deque_subscr()`, if `index_val` equals `self->alloc`, the index
correction `index_val -= self->alloc` does not execute, leading to an
out-of-bounds access in `self->items[index_val]`.
The fix in this commit ensures that the index correction is applied
whenever `index_val >= self->alloc`, preventing access beyond the allocated
buffer size.
Signed-off-by: Jan Sturm <jansturm92@googlemail.com>
Diffstat (limited to 'py')
| -rw-r--r-- | py/objdeque.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/py/objdeque.c b/py/objdeque.c index 2ad771284d..22c380a05a 100644 --- a/py/objdeque.c +++ b/py/objdeque.c @@ -208,7 +208,7 @@ static mp_obj_t deque_subscr(mp_obj_t self_in, mp_obj_t index, mp_obj_t value) { size_t offset = mp_get_index(self->base.type, deque_len(self), index, false); size_t index_val = self->i_get + offset; - if (index_val > self->alloc) { + if (index_val >= self->alloc) { index_val -= self->alloc; } |