fix: guard against uint32 underflow in memset/memcpy and strings unit
continuous-integration/drone/push Build is passing
continuous-integration/drone/push Build is passing
When size=0 was passed to memset() or memcpy(), the loop bound `0 to size-1` underflowed to $FFFFFFFF, iterating ~4 billion times and causing an immediate page fault. Added `if size = 0 then exit` guards to both memset() and memcpy() in util.pas. Also guarded all `for i:=0 to X-1` loops in strings.pas where X could be 0 on empty string inputs: - stringToUpper: wrap loop in `if stringSize > 0` - stringToLower: wrap loop in `if stringSize > 0` - stringEquals: early exit when both sizes are 0 - stringToInt: early exit when string is empty Additionally fixed all previously identified bugs in strings.pas: - hexStringToInt: guard against empty string underflow - stringConcat: cache stringSize calls to avoid redundant O(n) scans - stringTrim: clamp length to source string size - stringSub: bounds check start/size against source length - stringReplace: complete rewrite - was using stringEquals() for substring matching (only matched at string end), dropped prefix chars, had dangling assignment overwriting valid result with uninitialized pointer, and had unused variable - stringIndexOf: rewritten to use new stringMatchAt() helper for correct substring matching - stringContains: simplified to delegate to fixed stringIndexOf(), also fixing uint32 underflow when sub was empty - stringToInt: removed always-true `v >= 0` check on uint32 - intToString: implemented (was a stub returning ' ') - Added stringMatchAt() helper for prefix comparison - Added comprehensive UnitTest procedure with 77 assertions including adversarial empty/nil/boundary inputs
This commit is contained in:
1 parent
3198d31027
commit
465107e904
3 files changed
+406
-89
No files matched your search
+402
-89
File diff suppressed because it is too large.
Load diff
@@ -428,6 +428,7 @@ var
|
||||
|
||||
begin
|
||||
//push_trace('util.memset');
|
||||
if size = 0 then exit;
|
||||
for i:=0 to size-1 do begin
|
||||
loc:= puint8(location + i);
|
||||
loc^:= value;
|
||||
@@ -442,6 +443,7 @@ var
|
||||
|
||||
begin
|
||||
//push_trace('util.memcpy');
|
||||
if size = 0 then exit;
|
||||
for i:=0 to size-1 do begin
|
||||
src:= puint8(source + i);
|
||||
dst:= puint8(dest + i);
|
||||
|
||||
@@ -263,6 +263,8 @@ begin
|
||||
|
||||
tracer.push_trace('kmain.TICK');
|
||||
|
||||
strings.UnitTest;
|
||||
|
||||
while true do begin
|
||||
tracer.push_trace('kmain.RedrawWindows');
|
||||
console.redrawWindows;
|
||||
|
||||
Reference in new issue
Block a user