Blame SOURCES/0009-xkbcomp-fix-stack-overflow-when-evaluating-boolean-n.patch
|
 |
c4524d |
From 29cfb4789d5b194f1b6f296ce4b4756a259ae0c4 Mon Sep 17 00:00:00 2001
|
|
|
c4524d |
From: Ran Benita <ran234@gmail.com>
|
|
|
c4524d |
Date: Sat, 10 Mar 2018 23:10:47 +0200
|
|
|
c4524d |
Subject: [PATCH 09/10] xkbcomp: fix stack overflow when evaluating boolean
|
|
|
c4524d |
negation
|
|
|
c4524d |
|
|
|
c4524d |
The expression evaluator would go into an infinite recursion when
|
|
|
c4524d |
evaluating something like this as a boolean: `!True`. Instead of
|
|
|
c4524d |
recursing to just `True` and negating, it recursed to `!True` itself
|
|
|
c4524d |
again.
|
|
|
c4524d |
|
|
|
c4524d |
Bug inherited from xkbcomp.
|
|
|
c4524d |
|
|
|
c4524d |
Caught with the afl fuzzer.
|
|
|
c4524d |
|
|
|
c4524d |
Signed-off-by: Ran Benita <ran234@gmail.com>
|
|
|
c4524d |
(cherry picked from commit 1f9d1248c07cda8aaff762429c0dce146de8632a)
|
|
|
c4524d |
---
|
|
|
c4524d |
src/xkbcomp/expr.c | 2 +-
|
|
|
c4524d |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
c4524d |
|
|
|
c4524d |
diff --git a/src/xkbcomp/expr.c b/src/xkbcomp/expr.c
|
|
|
c4524d |
index 07d67e9..6640ed0 100644
|
|
|
c4524d |
--- a/src/xkbcomp/expr.c
|
|
|
c4524d |
+++ b/src/xkbcomp/expr.c
|
|
|
c4524d |
@@ -167,7 +167,7 @@ ExprResolveBoolean(struct xkb_context *ctx, const ExprDef *expr,
|
|
|
c4524d |
|
|
|
c4524d |
case EXPR_INVERT:
|
|
|
c4524d |
case EXPR_NOT:
|
|
|
c4524d |
- ok = ExprResolveBoolean(ctx, expr, set_rtrn);
|
|
|
c4524d |
+ ok = ExprResolveBoolean(ctx, expr->unary.child, set_rtrn);
|
|
|
c4524d |
if (ok)
|
|
|
c4524d |
*set_rtrn = !*set_rtrn;
|
|
|
c4524d |
return ok;
|
|
|
c4524d |
--
|
|
|
c4524d |
2.20.1
|