-
Notifications
You must be signed in to change notification settings - Fork 809
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Heap buffer overflow in kilo's editor_update_syntax(…) #36
Comments
This issue has been fixed in my |
Well then you could try sending a pull request upstream we all will get it aswell in the process. |
@pankajdoharey I think @antirez' intention is to let any further development be done by others in their respective forks, so submitted pull requests have not being merged into this repo historically. So I'm afraid a PR is unlikely to be merged. Luckily the fix is trivial, just check so that |
@practicalswift WoW. Well in that case may be he should handover the maintenance to someone able in the community. |
@antirez What's the sitrep on this repo? Are you going to be maintaining it? |
Safe to say this is unmaintained? @antirez |
I'm also started a fork called kilopp. You are welcome to open issues regarding bugs in my repository. |
Hi,
Kilo appears to have a heap buffer overflow triggered by the
memcmp
call on line 475 of kilo.c:The signature of
memcmp
:memcmp
operates under the assumption thats1
ands2
are at leastn
bytes long each.This assumption clearly holds for the second argument (
keywords[j]
), but there are no checks in place that makes sure that this assumption holds also for the first argument (p
).The heap overflow can be verified by compiling
kilo
with ASAN enabled:The text was updated successfully, but these errors were encountered: