pike.git/ src/ operators.c

2011-03-03

2011-03-03 21:26:46 by Martin Stjernholm <mast@lysator.liu.se>

• 08ede9fc4c74e3682774c06c3a2ad7c1e5f98c93 (13 lines) (+13/-0) ^{[ Show | Annotate ]}
  Branch: 7.8

Fixed special cases when dividing the empty array with a number.

Looks like this could clobber memory a couple of elements past the end of
the empty array in the float case.

3828:    if(!len)    OP_DIVISION_BY_ZERO_ERROR("`/");    +  if (!Pike_sp[-2].u.array->size) { +  pop_n_elems (2); +  ref_push_array (&empty_array); +  return; +  } +     if(len<0)    {    len = -len;
3862:    if(len==0.0)    OP_DIVISION_BY_ZERO_ERROR("`/");    +  if (!Pike_sp[-2].u.array->size) { +  pop_n_elems (2); +  ref_push_array (&empty_array); +  return; +  } +     if(len<0)    {    len=-len;