summaryrefslogtreecommitdiff
path: root/lisp/emacs-lisp
diff options
context:
space:
mode:
authorPetteri Hintsanen <petterih@iki.fi>2024-03-10 23:30:11 -0400
committerStefan Monnier <monnier@iro.umontreal.ca>2024-03-10 23:30:11 -0400
commited43ad5b5652aed075348357121d9193256721c0 (patch)
treeffd499a01c2b0ad7ff5412ddea72ff667082e0eb /lisp/emacs-lisp
parent887789eecc8546d60a296ce9771ecb20fc280a4d (diff)
downloademacs-ed43ad5b5652aed075348357121d9193256721c0.tar.gz
emacs-ed43ad5b5652aed075348357121d9193256721c0.tar.bz2
emacs-ed43ad5b5652aed075348357121d9193256721c0.zip
(bindat--unpack-item): Sanitize vector length
Copyright-paperwork-exempt: yes * lisp/emacs-lisp/bindat.el (bindat--unpack-item): Sanitize vector length
Diffstat (limited to 'lisp/emacs-lisp')
-rw-r--r--lisp/emacs-lisp/bindat.el3
1 files changed, 3 insertions, 0 deletions
diff --git a/lisp/emacs-lisp/bindat.el b/lisp/emacs-lisp/bindat.el
index 73745e8c7ac..a2161022a89 100644
--- a/lisp/emacs-lisp/bindat.el
+++ b/lisp/emacs-lisp/bindat.el
@@ -204,6 +204,9 @@
('str (bindat--unpack-str len))
('strz (bindat--unpack-strz len))
('vec
+ (when (> len (length bindat-raw))
+ (error "Vector length %d is greater than raw data length %d."
+ len (length bindat-raw)))
(let ((v (make-vector len 0)) (vlen 1))
(if (consp vectype)
(setq vlen (nth 1 vectype)