Commit 80986361 authored by Friedrich W. H. Kossebau's avatar Friedrich W. H. Kossebau
Browse files

man kio: fix crash due to bad memory pointer on REQ_ps handling

7d11a093 accidentally moved the
memory pointer increase out of the '+'-handling branch, which would
either result in bad number being read or the pointer getting behind
the end and resulting in garbage memory processing, potentially ending
in a crash.

Also changing to using dedicated own variable "sign" instead of reusing
function-global variable "j" with meaningless name.
global

Fixed-in: 21.08.3
BUG: 443983
parent c3d52ebe
......@@ -3941,23 +3941,24 @@ static char *scan_request(char *c)
else
{
char *h = args[0].data();
j = 0;
int sign = 0;
i = 0;
if (*h == '-')
{
j = -1;
sign = -1;
h++;
}
else if (*h == '+') {
sign = 1;
h++;
}
else if (*h == '+')
j = 1;
h++;
scan_expression(h, &i);
if (!j)
if (sign == 0)
{
j = 1;
sign = 1;
if (i > 5) i = i - 10;
}
out_html(change_to_size(i*j));
out_html(change_to_size(sign * i));
}
break;
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment