diff --git a/librz/main/rz-asm.c b/librz/main/rz-asm.c index daa2b02ec4..95da890855 100644 --- a/librz/main/rz-asm.c +++ b/librz/main/rz-asm.c @@ -901,13 +901,18 @@ RZ_API int rz_main_rz_asm(int argc, const char *argv[]) { if (dis) { char *usrstr = rz_str_dup(opt.argv[opt.ind]); if (!usrstr) { - eprintf("rz-asm: disassemble rz_str_dup OOM\n"); + eprintf("rz-asm: failed to allocate string.\n"); ret = 1; goto beach; } len = strlen(usrstr); if (skip && len > skip) { skip *= 2; + if (skip > len) { + eprintf("rz-asm: invalid skip value (skip %" PFMT64u " > %" PFMT64u " len).\n", skip, len); + ret = 1; + goto beach; + } // eprintf ("SKIP (%s) (%lld)\n", usrstr, skip); memmove(usrstr, usrstr + skip, len - skip); len -= skip; diff --git a/test/db/tools/rz_asm b/test/db/tools/rz_asm index e2ed774d5e..2950051ac7 100644 --- a/test/db/tools/rz_asm +++ b/test/db/tools/rz_asm @@ -709,3 +709,15 @@ c64x Texas Instruments TMS320C64x DSP family tricore Generic TriCore CPU family by Infineon EOF RUN + +NAME=rz-asm invalid skip +FILE= +CMDS=< 11 len). +EOF +RUN