StreetLight
/
libxkbcommon
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

xkbcomp: fix stack overflow when evaluating boolean negation 

The expression evaluator would go into an infinite recursion when
evaluating something like this as a boolean: `!True`. Instead of
recursing to just `True` and negating, it recursed to `!True` itself
again.

Bug inherited from xkbcomp.

Caught with the afl fuzzer.

Signed-off-by: Ran Benita <ran234@gmail.com>
master
Ran Benita 2018-03-10 23:10:47 +02:00
parent 2cb5c2a3f3
commit 1f9d1248c0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/xkbcomp/expr.c
View File

@ -165,7 +165,7 @@ ExprResolveBoolean(struct xkb_context *ctx, const ExprDef *expr,
case EXPR_INVERT: case EXPR_INVERT:
case EXPR_NOT: case EXPR_NOT:
ok = ExprResolveBoolean(ctx, expr, set_rtrn); ok = ExprResolveBoolean(ctx, expr->unary.child, set_rtrn);
if (ok) if (ok)
*set_rtrn = !*set_rtrn; *set_rtrn = !*set_rtrn;
return ok; return ok;