Ticket #656 (Open)Wed Feb 26 16:21:29 UTC 2025
Serious memory corruption in BBC Basic (since 1987)
| Reported by: | nemo (145) | Severity: | Critical |
| Part: | RISC OS: Module | Release: | |
| Milestone: | Status | Open |
Details by nemo (145):
The error-message generation in MSG uses STRACC via R8 (ARGP) before passing the resulting error block to the error handler. The error handler resets R8 in case it is not ARGP, but MSG does not.
In ten different places in the whole-array code, R8 is used as a pointer into an array, so if there is any kind of numerical error – DivBy0, TooBig etc – MSG then writes the error report over the array, and potentially over whatever follows the array in memory.
The bug has been there since 1987 in various forms. MSG must reset R8 to ARGP before using it.
