aboutsummaryrefslogtreecommitdiff
path: root/src/zenhttp/httpserver.cpp
diff options
context:
space:
mode:
authorStefan Boberg <[email protected]>2026-04-16 19:24:29 +0200
committerStefan Boberg <[email protected]>2026-04-16 19:24:29 +0200
commit68d3cb24db0511dc24de2e0dcfc3a23601f15c9b (patch)
tree5ae3c492ea3adc53cdf6d643f5870e7edc8bedb4 /src/zenhttp/httpserver.cpp
parentFix use of uninitialized stat result in POSIX RemoveFileNative (diff)
downloadarchived-zen-68d3cb24db0511dc24de2e0dcfc3a23601f15c9b.tar.xz
archived-zen-68d3cb24db0511dc24de2e0dcfc3a23601f15c9b.zip
Fix VLA and potential stack overflow in GetCallstack on POSIX
The Linux/Mac branch declared a VLA as `void* Frames[FramesToSkip + FramesToCapture]`, using the caller-supplied frame counts directly as the stack-allocation size. Two problems: VLAs are a GCC extension, not standard C++, and any caller that passes (or can be coaxed into passing) a large or negative value can blow the stack. Even well-meaning callers can trip this since there is no cap on what GetCallstack is asked to capture. Replace the VLA with a fixed-size stack buffer of 256 frames and clamp the requested count to that bound before calling backtrace(), which is well above anything useful for practical stack traces. Include <algorithm> for std::min.
Diffstat (limited to 'src/zenhttp/httpserver.cpp')
0 files changed, 0 insertions, 0 deletions