Skip to content

Commit 08d520a

Browse files
Avoid theoretical overflow of uintptr_t in AddAllLinkedExtensions
PiperOrigin-RevId: 903908144
1 parent 1a5c5c5 commit 08d520a

1 file changed

Lines changed: 4 additions & 6 deletions

File tree

upb/mini_table/generated_registry.c

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
#include "upb/mini_table/generated_registry.h"
99

10+
#include <stddef.h>
1011
#include <stdint.h>
1112

1213
#include "upb/mem/alloc.h"
@@ -41,12 +42,9 @@ static bool _upb_GeneratedRegistry_AddAllLinkedExtensions(
4142
const UPB_PRIVATE(upb_GeneratedExtensionListEntry)* entry =
4243
UPB_PRIVATE(upb_generated_extension_list);
4344
while (entry != NULL) {
44-
// Comparing pointers to different objects is undefined behavior, so we
45-
// convert them to uintptr_t and compare their values.
46-
uintptr_t begin = (uintptr_t)entry->start;
47-
uintptr_t end = (uintptr_t)entry->stop;
48-
uintptr_t current = begin;
49-
while (current < end) {
45+
const char* current = (const char*)entry->start;
46+
const char* end = (const char*)entry->stop;
47+
while ((size_t)(end - current) >= sizeof(upb_MiniTableExtension)) {
5048
const upb_MiniTableExtension* ext =
5149
(const upb_MiniTableExtension*)current;
5250
// Sentinels and padding introduced by the linker can result in zeroed

0 commit comments

Comments
 (0)