[Ming-dev] Buffer overflow in "swf5compiler.flex" on very long lines of input

[Michael F. <fo...@ya...>]

Hi,

In ming 0.4.2, the count() function in src\swf5compiler.flex causes a 
buffer overflow for input lines longer than 1023 characters (which leads 
to a segmentation fault in the Gnash test suite).

Here's a patch:

--- swf5compiler-0.4.2.flex	2008-07-13 16:09:56.000000000 +0200
+++ swf5compiler.flex	2009-01-08 13:31:30.000000000 +0100
@@ -572,7 +572,7 @@
       if(column < 1023)
         msgline[column] = yytext[n];
     }
-   msgline[column] = 0;
+   msgline[column < 1023 ? column : 1023] = 0;
  }

  static void printprog()




Kind Regards,
M.F.