Add safety check to BitVec_Next_Hit.
Project: http://git-wip-us.apache.org/repos/asf/lucy/repo Commit: http://git-wip-us.apache.org/repos/asf/lucy/commit/66aba12b Tree: http://git-wip-us.apache.org/repos/asf/lucy/tree/66aba12b Diff: http://git-wip-us.apache.org/repos/asf/lucy/diff/66aba12b Branch: refs/heads/master Commit: 66aba12b38005102a67f5407975a8edc48eef4e8 Parents: 42640a6 Author: Marvin Humphrey <[email protected]> Authored: Wed Apr 13 15:19:19 2016 -0700 Committer: Marvin Humphrey <[email protected]> Committed: Wed Apr 13 16:10:59 2016 -0700 ---------------------------------------------------------------------- core/Lucy/Object/BitVector.c | 5 +++++ 1 file changed, 5 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/lucy/blob/66aba12b/core/Lucy/Object/BitVector.c ---------------------------------------------------------------------- diff --git a/core/Lucy/Object/BitVector.c b/core/Lucy/Object/BitVector.c index 6ae926f..0afcc71 100644 --- a/core/Lucy/Object/BitVector.c +++ b/core/Lucy/Object/BitVector.c @@ -193,6 +193,11 @@ BitVec_Next_Hit_IMP(BitVector *self, size_t tick) { uint8_t *const limit = ivars->bits + byte_size; uint8_t *ptr = ivars->bits + (tick >> 3); + if (ivars->cap > INT32_MAX / 8) { + THROW(ERR, "Capacity too large for Next_Hit: %u64", + (uint64_t)ivars->cap); + } + if (ptr >= limit) { return -1; }
