Closed tadeokondrak closed 5 years ago
Also, with
[General]
Mode: 1
[HitObjects]
0,0,0,2,0,0,-5,0,0
0,0,0,2,0,0,0,0,0
malloc will be passed a negative number and cause memory corruption.
So, a fix would be something like
if (nodes < 1) {
return ERR_SYNTAX;
} else if (/* calculate if sizeof(int)*nodes fits into an int */) {
return ERR_OOM;
}
nice find, this could be used to DDOS services relying on oppai, lol
will fix asap
here
With this file, m_alloc will be passed a number larger than sizeof(int) and crash:
Would submit a PR to fix but I'm not sure of the underlying reasons why some functions take the types they do so I'd probably get it wrong