Skip to content

Commit a6fc4cc

Browse files
SiteRelEnbygatk555
authored andcommitted
Fix UAF in read_ihex_chunks() when first chunk is reallocated
1 parent c6343c1 commit a6fc4cc

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

simavr/sim/sim_hex.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -172,8 +172,12 @@ read_ihex_chunks(
172172
allocation += INCREMENT;
173173
chunk = realloc(chunk, allocation + (sizeof *chunk - 1));
174174

175-
/* Update the pointer in the previous list element */
176-
if ( backlink_p ) backlink_p->next = chunk;
175+
/* Update the pointer in the previous list element or root */
176+
if ( backlink_p ) {
177+
backlink_p->next = chunk;
178+
} else {
179+
*chunks_p = chunk;
180+
}
177181

178182
/* Refresh the pointer to the future chunk */
179183
chunks_p = &chunk->next;

0 commit comments

Comments
 (0)