md4c

commit f0103c16e18a9328fb535ffbac0d4d3a81043852
parent 591b2d21ba75922acc07431fd366fbdd5537324f
Author: Martin Mitas <mity@morous.org>
Date:   Tue, 25 Jul 2017 00:26:43 +0200

MD_MARK structure: Do not limit prev/next members to 24 bits.

For normal kind of input, using full 32 bits makes no big difference.
And limiting those members to 24 bits was maybe a security issue.

That implied a limit of 2 ** 24 == 16,777,216 marks per a single block.
As big as it may seem, malicious input may contain more. And if the
input is carefully crafted, the mark chains could theoretically form a
circles due to some overflows in these members, which could maybe make
the parser to never finish.

Diffstat:
M
md4c/md4c.c
 | 
8
++++----

1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/md4c/md4c.c b/md4c/md4c.c
@@ -2436,10 +2436,10 @@ struct MD_MARK_tag {
      * During resolving, we disconnect from the chain and point to the
      * corresponding counterpart so opener points to its closer and vice versa.
      */
-    int prev    : 24;
-    int ch      : 8;    /* Only ASCII chars can form a mark. */
-    int next    : 24;
-    int flags   : 8;
+    int prev;
+    int next;
+    CHAR ch;
+    unsigned char flags;
 };
 
 /* Mark flags (these apply to ALL mark types). */