mirror of
https://github.com/mrkite/regs.git
synced 2024-11-29 04:49:16 +00:00
fixed buffer overflow in weird jumptables
This commit is contained in:
parent
4223d9f413
commit
da7a71c3bc
@ -40,7 +40,7 @@ class Map {
|
|||||||
void addEntry(uint32_t entry, uint32_t flags);
|
void addEntry(uint32_t entry, uint32_t flags);
|
||||||
void addSymbol(uint32_t org, std::string name);
|
void addSymbol(uint32_t org, std::string name);
|
||||||
uint32_t org;
|
uint32_t org;
|
||||||
uint8_t b;
|
uint8_t b = 0;
|
||||||
|
|
||||||
private:
|
private:
|
||||||
std::string mapname;
|
std::string mapname;
|
||||||
|
@ -386,7 +386,7 @@ bool OMF::relocSegments() {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
if (seg.isJump()) { // patch jumptable
|
if (seg.isJump()) { // patch jumptable
|
||||||
for (int i = 8; i < seg.length; i += 14) {
|
for (int i = 8; i < seg.length - 14; i += 14) {
|
||||||
uint16_t segnum = data[i + 4] | (data[i + 5] << 8);
|
uint16_t segnum = data[i + 4] | (data[i + 5] << 8);
|
||||||
int32_t subOffset = data[i + 6] | (data[i + 7] << 8) |
|
int32_t subOffset = data[i + 6] | (data[i + 7] << 8) |
|
||||||
(data[i + 8] << 16) | (data[i + 9] << 24);
|
(data[i + 8] << 16) | (data[i + 9] << 24);
|
||||||
|
Loading…
Reference in New Issue
Block a user