Buffer 'new_argv' is accessed without bound check after accessing with
bound check via 'new_argc' index.
Fixes: e298f3b49def ("kconfig: add built-in function support")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@xxxxxxxxxx>
---
scripts/kconfig/preprocess.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 748da578b418..d1f5bcff4b62 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -387,24 +387,27 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[])
if (new_argc >= FUNCTION_MAX_ARGS)
pperror("too many function arguments");
new_argv[new_argc++] = prev;
prev = p + 1;
} else if (*p == '(') {
nest++;
} else if (*p == ')') {
nest--;
}
p++;
}
+
+ if (new_argc >= FUNCTION_MAX_ARGS)
+ pperror("too many function arguments");
new_argv[new_argc++] = prev;
/*
* Shift arguments
* new_argv[0] represents a function name or a variable name. Put it
* into 'name', then shift the rest of the arguments. This simplifies
* 'const' handling.
*/
name = expand_string_with_args(new_argv[0], argc, argv);
new_argc--;
for (i = 0; i < new_argc; i++)
new_argv[i] = expand_string_with_args(new_argv[i + 1],
--
2.34.1
