mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2024-08-16 17:00:35 +03:00
AK: Always check shift amount in LEB128 read functions
Even shifting 0 by more than the value size is UB.
This commit is contained in:
parent
cefc931347
commit
41b2d37e8a
Notes:
sideshowbarker
2024-07-17 09:33:51 +09:00
Author: https://github.com/kleinesfilmroellchen Commit: https://github.com/SerenityOS/serenity/commit/41b2d37e8a Pull-request: https://github.com/SerenityOS/serenity/pull/14518
@ -36,7 +36,7 @@ struct LEB128 {
|
||||
return false;
|
||||
|
||||
ValueType masked_byte = byte & ~(1 << 7);
|
||||
bool const shift_too_large_for_result = (num_bytes * 7 > sizeof(ValueType) * 8) && (masked_byte != 0);
|
||||
bool const shift_too_large_for_result = num_bytes * 7 > sizeof(ValueType) * 8;
|
||||
if (shift_too_large_for_result)
|
||||
return false;
|
||||
|
||||
@ -83,7 +83,7 @@ struct LEB128 {
|
||||
|
||||
// note: 64 bit assumptions!
|
||||
u64 masked_byte = byte & ~(1 << 7);
|
||||
bool const shift_too_large_for_result = (num_bytes * 7 >= 64) && (masked_byte != ((temp < 0) ? 0x7Fu : 0u));
|
||||
bool const shift_too_large_for_result = num_bytes * 7 >= 64;
|
||||
if (shift_too_large_for_result)
|
||||
return false;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user