Fixed out-of-boundary read in pure kernel rule engine rule 'p' if parameter is set to 2 or higher

2020-02-10 16:32:34 +01:00
parent 9607b8c734
commit a74cbe3461
2 changed files with 12 additions and 1 deletions
@@ -300,7 +300,17 @@ DECLSPEC int mangle_dupeword_times (MAYBE_UNUSED const u8 p0, MAYBE_UNUSED const

  u8 *out = buf + len;

-  for (int t = 0; t < p0; t++) for (int i = 0; i < len; i++) *out++ = *buf++;
+  int out_pos = len;
+
+  for (int t = 0; t < p0; t++)
+  {
+    for (int i = 0; i < len; i++)
+    {
+      out[out_pos] = buf[i];
+
+      out_pos++;
+    }
+  }

  return (out_len);
 }