From d2386df0d6f8edc61cba739623a360fdeeecb3d2 Mon Sep 17 00:00:00 2001 From: Jihoon Kim Date: Wed, 17 Jan 2024 20:06:13 +0900 Subject: [PATCH] Fix integer overflow issue Possible integer underflow: left operand is tainted. An integer underflow may occur due to arithmetic operation (unsigned subtraction) between values { [0, 4294967295] } and '1', where the first value comes from the expression 'strlen(*worditer)' Change-Id: I6664af6907644f34e5225fff91dca5209f55eaf0 Signed-off-by: Jihoon Kim --- bench/atom.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bench/atom.c b/bench/atom.c index 7d78f64..e4c290b 100644 --- a/bench/atom.c +++ b/bench/atom.c @@ -47,6 +47,7 @@ main(void) const char *text; struct bench bench; char *elapsed; + size_t word_len; darray_init(words); file = fopen("/usr/share/dict/words", "rb"); @@ -68,7 +69,8 @@ main(void) assert(table); darray_foreach(worditer, words) { - atom = atom_intern(table, *worditer, strlen(*worditer) - 1, true); + word_len = strlen(*worditer) > 0 ? strlen(*worditer) - 1 : 0; + atom = atom_intern(table, *worditer, word_len, true); assert(atom != XKB_ATOM_NONE); text = atom_text(table, atom); -- 2.7.4