From 7ef327f6f269c7a49357e001cd41d7aaf5807749 Mon Sep 17 00:00:00 2001 From: Colomban Wendling Date: Tue, 3 Sep 2024 16:32:35 +0200 Subject: Fix invalid memory access with invalid powers The ParseNode's value must be valid to pass to `free()`, as it's done unconditionally if the expression is invalid. However, for some functions a shortuct was taken avoiding duplicating memory. This was OK in case the expression is valid because the evaluation function would convert it and set the pointer back to NULL; but it's not OK if the expression is invalid as the evaluation doesn't happen and the pointer is not reset before being freed. Fixes #226. --- src/parserfunc.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'src/parserfunc.c') diff --git a/src/parserfunc.c b/src/parserfunc.c index 6f27daf..dc28e7e 100644 --- a/src/parserfunc.c +++ b/src/parserfunc.c @@ -230,9 +230,9 @@ pf_get_variable_with_power(ParseNode* self) MPNumber t = mp_new(); MPNumber* ans = mp_new_ptr(); - pow = super_atoi(((LexerToken*) self->value)->string); + pow = super_atoi(self->value); - /* No need to free the memory. It is allocated and freed somewhere else. */ + free(self->value); self->value = NULL; if(!(self->state->get_variable)) @@ -344,10 +344,11 @@ pf_apply_func_with_power(ParseNode* self) set_error(self->state, PARSER_ERR_UNKNOWN_FUNCTION, self->token->string); return NULL; } - pow = super_atoi(((LexerToken*) self->value)->string); + pow = super_atoi(self->value); mp_xpowy_integer(tmp, pow, ans); mp_free(val); mp_free(tmp); + free(self->value); self->value = NULL; return ans; } @@ -391,11 +392,12 @@ pf_apply_func_with_npower(ParseNode* self) set_error(self->state, PARSER_ERR_UNKNOWN_FUNCTION, self->token->string); return NULL; } - pow = super_atoi(((LexerToken*) self->value)->string); + pow = super_atoi(self->value); mp_xpowy_integer(tmp, -pow, ans); mp_free(val); mp_free(tmp); free(inv_name); + free(self->value); self->value = NULL; return ans; } @@ -407,7 +409,8 @@ pf_do_nth_root(ParseNode* self) MPNumber* val; gint pow; MPNumber* ans = mp_new_ptr(); - pow = sub_atoi(((LexerToken*) self->value)->string); + pow = sub_atoi(self->value); + free(self->value); self->value = NULL; val = (MPNumber*) (*(self->right->evaluate))(self->right); if(!val) -- cgit v1.2.1