(bindat--unpack-item): Sanitize vector length

Copyright-paperwork-exempt: yes

* lisp/emacs-lisp/bindat.el (bindat--unpack-item): Sanitize vector length

(cherry picked from commit ed43ad5b5652aed075348357121d9193256721c0)

diff --git a/lisp/emacs-lisp/bindat.el b/lisp/emacs-lisp/bindat.el
index 73745e8c7ac319e86173aef2df0956b74ba348bb..a2161022a89caf54f650ab4b25a154534105d044 100644 (file)
--- a/lisp/emacs-lisp/bindat.el
+++ b/lisp/emacs-lisp/bindat.el
@@ -204,6 +204,9 @@
    ('str (bindat--unpack-str len))
    ('strz (bindat--unpack-strz len))
    ('vec
+    (when (> len (length bindat-raw))
+      (error "Vector length %d is greater than raw data length %d."
+             len (length bindat-raw)))
     (let ((v (make-vector len 0)) (vlen 1))
       (if (consp vectype)
          (setq vlen (nth 1 vectype)