Segfaults on bad arguments to register_theme (XS)

[irssibot]

• • • Issue #844 opened by @zibri

When passing a reference that isn't an arrayref to register_theme in the Perl API, the process segfaults. This is caused by insufficent validation of the passed argument. The proposed patch verifies that "formats" is an array reference before continuing.

[irssibot]

• • • Attachment 281 by @zibri

register_theme_segv.diff

Index: src/perl/ui/Themes.xs
===================================================================
--- src/perl/ui/Themes.xs   (revision 5213)
+++ src/perl/ui/Themes.xs   (working copy)
@@ -90,8 +90,12 @@
 CODE:

         if (!SvROK(formats))
-           croak("formats is not a reference to list");
+           croak("formats is not a reference");
+
    av = (AV *) SvRV(formats);
+   if(SvTYPE(av) != SVt_PVAV)
+           croak("formats is not a reference to a list");
+
    len = av_len(av)+1;
    if (len == 0 || (len & 1) != 0)
            croak("formats list is invalid - not divisible by 2 (%d)", len);

[irssibot]

• • • Comment 1355 by @zibri

Oops, I mean theme_register of course. Sorry :-).

[irssibot]

• • • Closed by @ayin

Fixed in r5214.