Disallow Unicode conversion specifications.

This stops fish from accessing the `bool ok[UCHAR_MAX + 1]` table
beyond allocated space potentially accessing memory that doesn't
belong to fish, and crashing.
This commit is contained in:
Konrad Borowski 2013-11-27 21:16:34 +01:00
parent 1eb09f3eb2
commit e0b78f7f2a

View file

@ -732,7 +732,7 @@ no_more_flag_characters:
{ {
wchar_t conversion = *f; wchar_t conversion = *f;
if (! ok[conversion]) if (conversion > 0xFF || ! ok[conversion])
{ {
this->fatal_error(_(L"%.*ls: invalid conversion specification"), (int)(f + 1 - direc_start), direc_start); this->fatal_error(_(L"%.*ls: invalid conversion specification"), (int)(f + 1 - direc_start), direc_start);
return 0; return 0;