fix(gentype): ctypedef 检查 strcmp 改 strncmp 限长比较,修 stdint.vp 读穿崩溃
prefix=1(attr 内容 'CTypedef' 正确)后仍崩——attr 是零拷贝引用 src_buf 的 token 字符串,无 NUL 结尾(后跟空格/其他字符),strcmp 无限读穿到页边界 0xC0000005。改 strncmp 限长 8 + 第 9 字节分隔符 校验;mod_id 的 strcmp 同样改 strncmp。
This commit is contained in:
1 parent
8db2d1c23b
commit
23945cd168
1 file changed
+15
-5
@@ -150,14 +150,19 @@ class TypeGenCType(TypeGenBase.TypeGenBase):
|
||||
if at_attr_v[0] == 'C' and at_attr_v[1] == 'T' \
|
||||
and at_attr_v[2] == 'y' and at_attr_v[3] == 'p':
|
||||
attr_ok_d = 1
|
||||
stdio.printf("[DIAG] ctypedef 检查: attr=%llu prefix=%d\n",
|
||||
t.CUInt64T(at_attr_v), attr_ok_d)
|
||||
if at_attr_v is None:
|
||||
return 0
|
||||
if attr_ok_d == 0:
|
||||
# 内容损坏:跳过 strcmp(防读穿崩),返回 0(非 CTypedef)
|
||||
return 0
|
||||
if string.strcmp(at_attr_v, "CTypedef") != 0:
|
||||
# 限长比较替代 strcmp:attr 是零拷贝引用 src_buf 的 token 字符串,
|
||||
# 可能无 NUL 结尾("CTypedef" 后紧跟空格/其他字符),strcmp 会
|
||||
# 无限读穿到页边界 → 0xC0000005(stdint.vp 崩溃根因)。strncmp
|
||||
# 只读 8 字节,再校验第 9 字节为终止/分隔符(防 "CTypedefXXX" 误匹配)。
|
||||
if string.strncmp(at_attr_v, "CTypedef", 8) != 0:
|
||||
return 0
|
||||
sep_ch_d: t.CChar = at_attr_v[8]
|
||||
if sep_ch_d != '\0' and sep_ch_d != ' ' and sep_ch_d != '\n' \
|
||||
and sep_ch_d != '\r' and sep_ch_d != '\t' and sep_ch_d != '|':
|
||||
return 0
|
||||
at_val_v: ast.AST | t.CPtr = ast.attribute_get_value(at)
|
||||
if at_val_v is None or at_val_v.kind() != ast.ASTKind.Name:
|
||||
@@ -166,7 +171,12 @@ class TypeGenCType(TypeGenBase.TypeGenBase):
|
||||
mod_id_v: str = ast.name_get_id(mod_nm)
|
||||
if mod_id_v is None:
|
||||
return 0
|
||||
if string.strcmp(mod_id_v, "t") != 0:
|
||||
# 同样限长比较("t" 无 NUL 结尾时 strcmp 读穿)
|
||||
if string.strncmp(mod_id_v, "t", 1) != 0:
|
||||
return 0
|
||||
sep_ch_m: t.CChar = mod_id_v[1]
|
||||
if sep_ch_m != '\0' and sep_ch_m != ' ' and sep_ch_m != '\n' \
|
||||
and sep_ch_m != '\r' and sep_ch_m != '\t' and sep_ch_m != '|':
|
||||
return 0
|
||||
return 1
|
||||
def ScanCTypedefDeclarations(self, pool: memhub.MemBuddy | t.CPtr,
|
||||
|
||||
Reference in new issue
Block a user