riscv
/
yosys
mirror of https://github.com/YosysHQ/yosys.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fixed use of limited length buffer in ABC blif parser

This commit is contained in:
Clifford Wolf 2013-12-31 21:58:35 +01:00
parent ab3f6266ad
commit e09ebf475c
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
passes/abc/blifparse.cc
View File

@ -22,22 +22,28 @@
#include <stdio.h> #include <stdio.h>
#include <string.h> #include <string.h>
static bool read_next_line(char *buffer, int &line_count, FILE *f) static bool read_next_line(char *&buffer, size_t &buffer_size, int &line_count, FILE *f)
{ {
int buffer_len = 0;
buffer[0] = 0; buffer[0] = 0;
while (1) while (1)
{ {
int buffer_len = strlen(buffer); buffer_len += strlen(buffer + buffer_len);
while (buffer_len > 0 && (buffer[buffer_len-1] == ' ' || buffer[buffer_len-1] == '\t' || while (buffer_len > 0 && (buffer[buffer_len-1] == ' ' || buffer[buffer_len-1] == '\t' ||
buffer[buffer_len-1] == '\r' || buffer[buffer_len-1] == '\n')) buffer[buffer_len-1] == '\r' || buffer[buffer_len-1] == '\n'))
buffer[--buffer_len] = 0; buffer[--buffer_len] = 0;
if (buffer_size-buffer_len < 4096) {
buffer_size *= 2;
buffer = (char*)realloc(buffer, buffer_size);
}
if (buffer_len == 0 || buffer[buffer_len-1] == '\\') { if (buffer_len == 0 || buffer[buffer_len-1] == '\\') {
if (buffer[buffer_len-1] == '\\') if (buffer[buffer_len-1] == '\\')
buffer[--buffer_len] = 0; buffer[--buffer_len] = 0;
line_count++; line_count++;
if (fgets(buffer+buffer_len, 4096-buffer_len, f) == NULL) if (fgets(buffer+buffer_len, buffer_size-buffer_len, f) == NULL)
return false; return false;
} else } else
return true; return true;
@ -56,12 +62,13 @@ RTLIL::Design *abc_parse_blif(FILE *f, std::string dff_name)
module->name = "\\netlist"; module->name = "\\netlist";
design->modules[module->name] = module; design->modules[module->name] = module;
char buffer[4096]; size_t buffer_size = 4096;
char *buffer = (char*)malloc(buffer_size);
int line_count = 0; int line_count = 0;
while (1) while (1)
{ {
if (!read_next_line(buffer, line_count, f)) if (!read_next_line(buffer, buffer_size, line_count, f))
goto error; goto error;
continue_without_read: continue_without_read:
@ -83,8 +90,10 @@ RTLIL::Design *abc_parse_blif(FILE *f, std::string dff_name)
if (!strcmp(cmd, ".model")) if (!strcmp(cmd, ".model"))
continue; continue;
if (!strcmp(cmd, ".end")) if (!strcmp(cmd, ".end")) {
free(buffer);
return design; return design;
}
if (!strcmp(cmd, ".inputs") || !strcmp(cmd, ".outputs")) { if (!strcmp(cmd, ".inputs") || !strcmp(cmd, ".outputs")) {
char *p; char *p;
@ -174,7 +183,7 @@ RTLIL::Design *abc_parse_blif(FILE *f, std::string dff_name)
if (input_sig.width == 0) { if (input_sig.width == 0) {
RTLIL::State state = RTLIL::State::Sa; RTLIL::State state = RTLIL::State::Sa;
while (1) { while (1) {
if (!read_next_line(buffer, line_count, f)) if (!read_next_line(buffer, buffer_size, line_count, f))
goto error; goto error;
for (int i = 0; buffer[i]; i++) { for (int i = 0; buffer[i]; i++) {
if (buffer[i] == ' ' || buffer[i] == '\t') if (buffer[i] == ' ' || buffer[i] == '\t')