Constant pool overflow (PATCH2)

Here is the new one. No more check on number of constants.
--strk;

------8<-----------------------------------------------------------

diff -rU2 ming.000/src/actioncompiler/compile.c ming/src/actioncompiler/compile.c
--- ming.000/src/actioncompiler/compile.c       Wed Sep 17 15:57:10 2003
+++ ming/src/actioncompiler/compile.c   Thu Sep 18 12:10:21 2003
@@ -29,5 +29,5 @@
 #include "compile.h"

-static int nConstants = {0}, maxConstants = {0};
+static int nConstants = {0}, maxConstants = {0}, sizeConstants = {0};
 static char **constants;

@@ -121,7 +121,12 @@
        }

+       /* Don't let constant pool biggern then allowed */
+       if ( sizeConstants+strlen(s)+1 > MAXCONSTANTPOOLSIZE ) return -1;
+
        if(nConstants == maxConstants)
                constants = (char **) realloc(constants, (maxConstants += 64) * sizeof(char *));
+
        constants[nConstants] = strdup(s);
+       sizeConstants += (strlen(s)+1);
        return nConstants++;
 }
diff -rU2 ming.000/src/actioncompiler/compile.h ming/src/actioncompiler/compile.h
--- ming.000/src/actioncompiler/compile.h       Wed Sep 17 15:57:10 2003
+++ ming/src/actioncompiler/compile.h   Thu Sep 18 12:05:33 2003
@@ -118,4 +118,5 @@
 int addConstant(const char *s);
 int bufferWriteConstants(Buffer out);
+#define MAXCONSTANTPOOLSIZE 65533

 /* write data to buffer */

------8<-----------------------------------------------------------

strk wrote:
> hamann.w wrote:
> > Hi strk,
> > 
> > thanks for the patch - unfortunately you are wrong about the MAXPOOLITEMS
> > The swf format (even in SWF5) allows for bigger string indices. It uses code 8
> > for the single-byte index and 9 for a two-byte index. Consequently there is no limit on
> > the pool items, only on the total pool size in bytes
> > 
> > Wolfgang
> 
> Two-bytes index gives a limit of 65536 Costants, right ?
> The 3rd field of a SWFCONSTANT_POOL record  expresses the
> number of constants:
>         bufferWriteS16(out, nConstants);
> Thus, if 0 is a valid value, limit becomes 65535.
> 
> As for the total pool size, the second field of ANY ActionRecord
> with code >= 0x80 (0x88 in our case) is a 16bit lenght specification.
> As before, if 0 is a valid value we can specify at most 65535 bytes
> as the lenght of any record. Since SWFCONSTANT_POOL record uses
> 2 of those bytes to store the number of costants in the pool we
> have 65533 bytes left usable by the constants strings including
> the trailing 0.
> 
>   NOTE that it is practically IMPOSSIBLE to hit the number of constants
>   limit before the total size limit, since any constant string will
>   take in space at least 2bytes (one for the char and one for the NULL)
>   so total pool size will be always at least double the number of
>   constants.
> 
> So yes, you are right Wolf !
> I'll modify my patch removing checks on nConstants value.
> 
> --strk;
> 
> _______________________________________________
> ming-fun mailing list
> [email protected]
> http://www.opaque.net/mailman/listinfo/ming-fun