OpenWaterAnalytics / EPANET

The Water Distribution System Hydraulic and Water Quality Analysis Toolkit
MIT License
279 stars 204 forks source link

fixes issue where a string position causes underflow #676

Closed samhatchett closed 2 years ago

samhatchett commented 2 years ago

under some circumstances, like certain input lines that have long comments, the code here can cause an underflow in size_t which casts to a very large integer during comparison and results in the number of tokens being over-reported (max of 40). Most of these tokens are of course garbage. Changing this len variable to an integer permits it to be less than zero, thus allowing an exit from the while at L665.

LRossman commented 2 years ago

I'm a little confused about the logic behind this change (although I'm not objecting to it). Lines read from the input file are limited to 1024 characters so it shouldn't matter how long the original comment is (it will get truncated when read) or whether its length is stored in an int or a size_t.

LRossman commented 2 years ago

Ok, I see now where the issue lies. It's at line 674 where lengets decremented as each token is found. This could create a problem if lenbecomes negative, causing an underflow for a size_t (unsigned int) variable.