From ef087c3849cfbe58f4f77e09367d6fbf152e5498 Mon Sep 17 00:00:00 2001
From: Sebastiano Tronto <sebastiano@tronto.net>
Date: Sat, 12 Oct 2024 17:06:50 +0200
Subject: Make writemoves (and solver) safer by checking buffer size

---
 src/solvers/h48/solve.h             | 22 +++++++++++++++++++---
 src/solvers/h48/solve_multithread.h | 23 +++++++++++++++++++----
 2 files changed, 38 insertions(+), 7 deletions(-)

(limited to 'src/solvers')

diff --git a/src/solvers/h48/solve.h b/src/solvers/h48/solve.h
index f2babdf..bcc8b33 100644
--- a/src/solvers/h48/solve.h
+++ b/src/solvers/h48/solve.h
@@ -10,6 +10,7 @@ typedef struct {
 	uint8_t k;
 	const uint32_t *cocsepdata;
 	const uint8_t *h48data;
+	uint64_t solutions_size;
 	char **nextsol;
 	uint8_t nissbranch;
 	int8_t npremoves;
@@ -55,26 +56,40 @@ allowednextmove_h48(uint8_t *moves, uint8_t n, uint32_t h48branch)
 STATIC void
 solve_h48_appendsolution(dfsarg_solveh48_t *arg)
 {
-	int strl;
+	int64_t strl;
 	uint8_t invertedpremoves[MAXLEN];
 	char *solution = *arg->nextsol; 
 
-	strl = writemoves(arg->moves, arg->nmoves, *arg->nextsol);
+	strl = writemoves(
+	    arg->moves, arg->nmoves, arg->solutions_size, *arg->nextsol);
+
+	if (strl < 0)
+		goto solve_h48_appendsolution_error;
 	*arg->nextsol += strl; 
+	arg->solutions_size -= strl;
 
 	if (arg->npremoves) {
 		**arg->nextsol = ' ';
 		(*arg->nextsol)++;
 
 		invertmoves(arg->premoves, arg->npremoves, invertedpremoves);
-		strl = writemoves(invertedpremoves, arg->npremoves, *arg->nextsol);
+		strl = writemoves(invertedpremoves,
+		    arg->npremoves, arg->solutions_size, *arg->nextsol);
+
+		if (strl < 0)
+			goto solve_h48_appendsolution_error;
 		*arg->nextsol += strl;
+		arg->solutions_size -= strl;
 	}
 	LOG("Solution found: %s\n", solution);
 
 	**arg->nextsol = '\n';
 	(*arg->nextsol)++;
 	(*arg->nsols)++;
+
+solve_h48_appendsolution_error:
+	/* We could add some logging, but writemoves() already does */
+	return;
 }
 
 STATIC_INLINE bool
@@ -188,6 +203,7 @@ solve_h48(
 		.k = info.bits,
 		.cocsepdata = get_cocsepdata_constptr(data),
 		.h48data = get_h48data_constptr(data),
+		.solutions_size = solutions_size,
 		.nextsol = &solutions
 	};
 
diff --git a/src/solvers/h48/solve_multithread.h b/src/solvers/h48/solve_multithread.h
index 3ba914a..8e00404 100644
--- a/src/solvers/h48/solve_multithread.h
+++ b/src/solvers/h48/solve_multithread.h
@@ -27,12 +27,17 @@ STATIC void
 solve_h48_appendsolution_thread(dfsarg_solveh48_t *arg, task_queue_t *tq)
 {
 	pthread_mutex_lock(&tq->mutex);
-	int strl = 0;
+	int64_t strl = 0;
 	uint8_t invertedpremoves[MAXLEN];
 	char *solution = *arg->nextsol;
 
-	strl = writemoves(arg->moves, arg->nmoves, *arg->nextsol);
+	strl = writemoves(
+	    arg->moves, arg->nmoves, arg->solutions_size, *arg->nextsol);
+
+	if (strl < 0)
+		goto solve_h48_appendsolution_thread_error;
 	*arg->nextsol += strl;
+	arg->solutions_size -= strl;
 
 	if (arg->npremoves)
 	{
@@ -40,14 +45,22 @@ solve_h48_appendsolution_thread(dfsarg_solveh48_t *arg, task_queue_t *tq)
 		(*arg->nextsol)++;
 
 		invertmoves(arg->premoves, arg->npremoves, invertedpremoves);
-		strl = writemoves(invertedpremoves, arg->npremoves, *arg->nextsol);
+		strl = writemoves(invertedpremoves,
+		    arg->npremoves, arg->solutions_size, *arg->nextsol);
+
+		if (strl < 0)
+			goto solve_h48_appendsolution_thread_error;
 		*arg->nextsol += strl;
+		arg->solutions_size -= strl;
 	}
 	LOG("Solution found: %s\n", solution);
 
 	**arg->nextsol = '\n';
 	(*arg->nextsol)++;
 	(*arg->nsols)++;
+
+solve_h48_appendsolution_thread_error:
+	/* We could add some logging, but writemoves() already does */
 	pthread_mutex_unlock(&tq->mutex);
 }
 
@@ -264,7 +277,9 @@ solve_h48_multithread(
 		.k = info.bits,
 		.cocsepdata = get_cocsepdata_constptr(data),
 		.h48data = get_h48data_constptr(data),
-		.nextsol = &solutions};
+		.solutions_size = solutions_size,
+		.nextsol = &solutions
+	};
 
 	task_queue_t q;
 	init_queue(&q);
-- 
cgit v1.3