[prev in list] [next in list] [prev in thread] [next in thread] 

List:       gnash-commit
Subject:    [Gnash-commit] /srv/bzr/gnash/trunk r9867: Another abort in
From:       Benjamin Wolsey <bwy () benjaminwolsey ! de>
Date:       2008-09-29 16:31:03
Message-ID: E1KkN3h-00032X-1u () sv ! gnu ! org
[Download RAW message or body]

------------------------------------------------------------
revno: 9867
committer: Benjamin Wolsey <bwy@benjaminwolsey.de>
branch nick: trunk
timestamp: Mon 2008-09-29 18:31:03 +0200
message:
  Another abort in action_buffer.
modified:
  libcore/vm/ASHandlers.cpp
    ------------------------------------------------------------
    revno: 9860.1.3
    committer: Benjamin Wolsey <bwy@benjaminwolsey.de>
    branch nick: work
    timestamp: Mon 2008-09-29 18:10:53 +0200
    message:
      Do the right cast to prevent attempt out-of-bounds access to constant pool.
    modified:
      libcore/vm/ASHandlers.cpp

["r9867.diff" (r9867.diff)]

=== modified file 'libcore/vm/ASHandlers.cpp'
--- a/libcore/vm/ASHandlers.cpp	2008-09-24 14:38:56 +0000
+++ b/libcore/vm/ASHandlers.cpp	2008-09-29 16:10:53 +0000
@@ -2063,7 +2063,7 @@
             {
                 id = code[3 + i];
                 i++;
-                if ( id < static_cast<int>(code.dictionary_size()) )
+                if (static_cast<size_t>(id) < code.dictionary_size())
                 {
                     env.push( code.dictionary_get(id) );
                 }
@@ -2082,7 +2082,7 @@
             {
                 id = code.read_int16(i+3);
                 i += 2;
-                if ( id < static_cast<int>(code.dictionary_size()) )
+                if ( static_cast<size_t>(id) < code.dictionary_size())
                 {
                     env.push( code.dictionary_get(id) );
                 }



_______________________________________________
Gnash-commit mailing list
Gnash-commit@gnu.org
http://lists.gnu.org/mailman/listinfo/gnash-commit


[prev in list] [next in list] [prev in thread] [next in thread]