BigfootDev/flatbuffers-bigfoot
1
0
Fork 0
forked from BigfootDev/flatbuffers
Code Pull Requests Activity

Merge pull request #274 from cogumbreiro/master

Browse Source 
Fix an out-of bounds read when the element is bigger than the buffer.
This commit is contained in:
Wouter van Oortmerssen
2015-09-23 12:37:45 -07:00
parent 2736711d67 477fedccd4
commit 811a5c3389
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/flatbuffers/flatbuffers.h
View File

@@ -898,7 +898,7 @@ class Verifier FLATBUFFERS_FINAL_CLASS {
// Verify any range within the buffer.
bool Verify(const void *elem, size_t elem_len) const {
return Check(elem >= buf_ && elem <= end_ - elem_len);
return Check(elem_len <= (size_t) (end_ - buf_) && elem >= buf_ && elem <= end_ - elem_len);
}
// Verify a range indicated by sizeof(T).