Fix incorrect size comparison in lexer_consume_n
The buffer length len and the requested number of tokens n are mixed up in an invalid comparison. This causes all valid requests for n < len tokens to be denied and all invalid requests for n > len tokens to be accepted. This may cause a buffer overflow if the caller requests more characters than they provide space for.
This commit is contained in:
		| @@ -183,7 +183,7 @@ error_t *lexer_consume_n(lexer_t *lex, const size_t len, | ||||
|                          char buffer[static len], const size_t n) { | ||||
|     if (lex->buffer_count < n) | ||||
|         return err_buffer_underrun; | ||||
|     if (len > n) | ||||
|     if (n > len) | ||||
|         return err_consume_excessive_length; | ||||
|  | ||||
|     memcpy(buffer, lex->buffer, n); | ||||
|   | ||||
		Reference in New Issue
	
	Block a user