From 043a272e887f17290efb4b5eda1f7b01b6bb2340 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 13 Dec 2016 01:17:52 +0100 Subject: segtree: wrong prefix expression length on interval_map_decompose() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit interval_map_decompose() sets expr->len to zero. This causes problems from expr_to_intervals() that calls range_expr_value_high() and calculates: expr->len - expr->prefix_len this operation underflows, then mpz_init_bitmask() allocates a huge bitmask. Use expr_value(i)->len given that we already use this to calculate the prefix length. Reported-by: Richard Mörbitz Signed-off-by: Pablo Neira Ayuso --- src/segtree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/segtree.c b/src/segtree.c index 32e071f6..45e5f5b2 100644 --- a/src/segtree.c +++ b/src/segtree.c @@ -693,7 +693,8 @@ void interval_map_decompose(struct expr *set) prefix_len = expr_value(i)->len - mpz_scan0(range, 0); prefix = prefix_expr_alloc(&low->location, expr_value(low), prefix_len); - prefix->len = low->len; + prefix->len = expr_value(i)->len; + prefix = set_elem_expr_alloc(&low->location, prefix); if (low->ops->type == EXPR_MAPPING) prefix = mapping_expr_alloc(&low->location, prefix, -- cgit v1.2.3