From e454cd2a3a02cfc41f463f232b5c1965d7c736bd Mon Sep 17 00:00:00 2001
From: Kaz Kylheku <kaz@kylheku.com>
Date: Thu, 4 May 2017 22:03:47 -0700
Subject: ffi: reject negative buf size.

* ffi.c (ffi_type_compile): Check for a negative buffer
size and throw.
---
 ffi.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'ffi.c')

diff --git a/ffi.c b/ffi.c
index 90bcf986..a079ceaf 100644
--- a/ffi.c
+++ b/ffi.c
@@ -1384,6 +1384,11 @@ val ffi_type_compile(val syntax)
                                        if3(sym == buf_s,
                                            ffi_buf_get, ffi_buf_d_get));
       struct txr_ffi_type *tft = ffi_type_struct(type);
+
+      if (nelem < 0)
+        uw_throwf(error_s, lit("~a: negative size in ~s"),
+                  self, syntax, nao);
+
       tft->alloc = ffi_buf_alloc;
       tft->free = ffi_noop_free;
       tft->nelem = nelem;
-- 
cgit v1.2.3