From f99b02c957ecb20967bb79b1f8afe4a2d40bc267 Mon Sep 17 00:00:00 2001 From: Meisam Bahadori Date: Thu, 30 Jul 2026 13:34:50 +0200 Subject: [PATCH] pa-227 --- src/frontend/snp2va.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/frontend/snp2va.c b/src/frontend/snp2va.c index 91c972f86..aa1c8273b 100644 --- a/src/frontend/snp2va.c +++ b/src/frontend/snp2va.c @@ -215,6 +215,13 @@ static int parse_touchstone(const char *fn, TS *out, char *msg, int msglen) const char *dot = strrchr(fn, '.'); if (dot && (dot[1]=='s'||dot[1]=='S') && (fn[strlen(fn)-1]=='p'||fn[strlen(fn)-1]=='P')) { N = atoi(dot+2); + /* Enhancement-227: reject an implausible port count from the filename + * (e.g. `.s2147483647p`). N is stored in out->N and used to size the + * downstream N x N vector fit; a huge N over-allocates / overflows and + * corrupts the heap. Real Touchstone files have few ports -- above the + * brute-force limit, drop back to inferring N from the data. */ + if (N > 512) + N = 0; } if (N <= 0) { int c;