Re: Re: Constant pool overflow (PATCH)

hamann.w wrote:
> Hi strk,
> 
> thanks for the patch - unfortunately you are wrong about the MAXPOOLITEMS
> The swf format (even in SWF5) allows for bigger string indices. It uses code 8
> for the single-byte index and 9 for a two-byte index. Consequently there is no limit on
> the pool items, only on the total pool size in bytes
> 
> Wolfgang

Two-bytes index gives a limit of 65536 Costants, right ?
The 3rd field of a SWFCONSTANT_POOL record  expresses the
number of constants:
        bufferWriteS16(out, nConstants);
Thus, if 0 is a valid value, limit becomes 65535.

As for the total pool size, the second field of ANY ActionRecord
with code >= 0x80 (0x88 in our case) is a 16bit lenght specification.
As before, if 0 is a valid value we can specify at most 65535 bytes
as the lenght of any record. Since SWFCONSTANT_POOL record uses
2 of those bytes to store the number of costants in the pool we
have 65533 bytes left usable by the constants strings including
the trailing 0.

  NOTE that it is practically IMPOSSIBLE to hit the number of constants
  limit before the total size limit, since any constant string will
  take in space at least 2bytes (one for the char and one for the NULL)
  so total pool size will be always at least double the number of
  constants.

So yes, you are right Wolf !
I'll modify my patch removing checks on nConstants value.

--strk;