Fix radareorg#2910 - two oob read with the command wo2

alvarofe · Jul 12, 2015 · dfb5058 · radare · Jul 12, 2015 · dfb5058
1 parent ecf6792
commit dfb5058
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/libr/core/cmd_write.c b/libr/core/cmd_write.c
@@ -71,8 +71,10 @@ static void cmd_write_op (RCore *core, const char *input) {
 		}
 	case '2':
 	case '4':
-		r_core_write_op (core, input+3, input[1]);
-		r_core_block_read (core, 0);
+		if (input[2]){
+			r_core_write_op (core, input+3, input[1]);
+			r_core_block_read (core, 0);
+		}
 		break;
 	case 'R':
 		r_core_cmd0 (core, "wr $b");

diff --git a/libr/core/io.c b/libr/core/io.c
@@ -150,7 +150,8 @@ R_API int r_core_write_op(RCore *core, const char *arg, char op) {
 	} else
 	if (op=='2' || op=='4') {
 		op -= '0';
-		for (i=0; i<core->blocksize; i+=op) {
+		// if i < core->blocksize would pass the test but buf[i+3] goes beyond the buffer
+		for (i=0; i<core->blocksize-3; i+=op) {
 			/* endian swap */
 			ut8 tmp = buf[i];
 			buf[i] = buf[i+3];