about summary refs log tree commit diff stats
diff options
context:
space:
mode:
authorSergei Trofimovich <slyich@gmail.com>2021-11-26 07:51:49 +0000
committerSergei Trofimovich <slyich@gmail.com>2021-11-26 07:54:01 +0000
commitf0a39a4b660cc27d40288216cb9e5a8611109c56 (patch)
tree4eccdd0ee7229147c594430102f424838b8c80cb
parenta77a57a6a45ed07c60b31f7cbe977f8e68fadbc8 (diff)
downloadprofani-tty-f0a39a4b660cc27d40288216cb9e5a8611109c56.tar.gz
python_api.c: enlarge `c_arguments` array to avoid OOB write
Code below explicitly refers past `args_len`th element:

        c_arguments[args_len][0] = NULL;
        c_arguments[args_len][1] = NULL;

Let's always allocate space for `NULL`. Noticed by Steffen Jaeckel.
-rw-r--r--src/plugins/python_api.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/plugins/python_api.c b/src/plugins/python_api.c
index 2ccd672b..90e33579 100644
--- a/src/plugins/python_api.c
+++ b/src/plugins/python_api.c
@@ -158,7 +158,7 @@ python_api_register_command(PyObject* self, PyObject* args)
         c_synopsis[len] = NULL;
 
         Py_ssize_t args_len = PyList_Size(arguments);
-        char* c_arguments[args_len == 0 ? 0 : args_len + 1][2];
+        char* c_arguments[args_len + 1][2];
         for (i = 0; i < args_len; i++) {
             PyObject* item = PyList_GetItem(arguments, i);
             Py_ssize_t len2 = PyList_Size(item);