Fix radareorg#2832 - oob read in r_mem_copyendian

alvarofe · alvarofe · commit 2198521dfb62 · 2015-06-28T12:03:18.000+02:00
diff --git a/libr/core/cmd.c b/libr/core/cmd.c
@@ -1531,6 +1531,7 @@ static int r_core_cmd_subst_i(RCore *core, char *cmd, char *colon) {
 				/* XXXX:YYYY */
 			} else {
 				*ptr2 = '\0';
+				if (!ptr2[1]) return -1;
 				r_core_block_size (core, r_num_math (core->num, ptr2+1));
 			}
 		}

Original file line number	Diff line number	Diff line change
`@@ -1531,6 +1531,7 @@ static int r_core_cmd_subst_i(RCore core, char cmd, char *colon) {`
`1531`	`1531`	`/* XXXX:YYYY */`
`1532`	`1532`	`} else {`
`1533`	`1533`	`*ptr2 = '\0';`
	`1534`	`+ if (!ptr2[1]) return -1;`
`1534`	`1535`	`r_core_block_size (core, r_num_math (core->num, ptr2+1));`
`1535`	`1536`	`}`
`1536`	`1537`	`}`