Skip to content

Commit fc6886b

Browse files
authored
Fix segfault of pv command. (#4883)
A non-numerical argument set repeat to 0 and lead to an integer overflow further down. This lead to OOB reading of memory.
1 parent e8db163 commit fc6886b

File tree

2 files changed

+20
-1
lines changed

2 files changed

+20
-1
lines changed

librz/core/cmd/cmd_print.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -4234,7 +4234,7 @@ static bool print_value(RzCore *core, PrintValueOptions *opts, RzCmdStateOutput
42344234

42354235
static RzCmdStatus print_value_size(RzCore *core, RzCmdStateOutput *state, int argc, const char **argv, ut64 size) {
42364236
int repeat = argc > 1 ? rz_num_math(NULL, argv[1]) : 1;
4237-
if (repeat < 0) {
4237+
if (repeat <= 0) {
42384238
return RZ_CMD_STATUS_ERROR;
42394239
}
42404240
PrintValueOptions opts = {

test/db/cmd/cmd_pv

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
NAME=pv
2+
FILE=
3+
CMDS=<<EOF
4+
# Invalid input, check for segfault
5+
pv iihasidbib
6+
pv 0x9
7+
EOF
8+
EXPECT=<<EOF
9+
0x0000000000000000
10+
0x0000000000000000
11+
0x0000000000000000
12+
0x0000000000000000
13+
0x0000000000000000
14+
0x0000000000000000
15+
0x0000000000000000
16+
0x0000000000000000
17+
0x0000000000000000
18+
EOF
19+
RUN

0 commit comments

Comments
 (0)