From 5c3a0637758d889a5c370e59a9488c5f7072734d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20Jaramago=20Fern=C3=A1ndez?= Date: Thu, 1 May 2025 17:22:54 +0200 Subject: [PATCH] Fix digest comment removal for queries over 'query_digests_max_query_length' Due to a typo/confusion, the boundary being used for comments check was 'd_max_len' instead of 'q_len'. This prevented the correct detection of a comment start when the query exceeded 'query_digests_max_query_length' which determines the value for 'd_max_len'. --- lib/c_tokenizer.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/c_tokenizer.cpp b/lib/c_tokenizer.cpp index 01d109b56..5281be3dc 100644 --- a/lib/c_tokenizer.cpp +++ b/lib/c_tokenizer.cpp @@ -447,7 +447,8 @@ enum p_st get_next_st(const options* opts, struct shared_st* shared_st) { // cmnt type 1 - start with '/*' if( // v1_crashing_payload_05 - shared_st->q_cur_pos < (shared_st->d_max_len-1) && *shared_st->q == '/' && *(shared_st->q+1) == '*' + shared_st->q_cur_pos < (shared_st->q_len - 2) && + *shared_st->q == '/' && *(shared_st->q+1) == '*' ) { st = st_cmnt_type_1; } @@ -458,7 +459,7 @@ enum p_st get_next_st(const options* opts, struct shared_st* shared_st) { // cmnt type 3 - start with '--' else if ( // shared_st->query isn't over, need to check next character - shared_st->q_cur_pos < (shared_st->d_max_len-2) && + shared_st->q_cur_pos < (shared_st->q_len - 2) && // found starting pattern '-- ' (space is required) *shared_st->q == '-' && *(shared_st->q+1) == '-' && is_space_char(*(shared_st->q+2)) ) {