# --- SDE-COPYRIGHT-NOTE-BEGIN --- # This copyright note is auto-generated by ./scripts/Create-CopyPatch. # # Filename: package/.../musl/fix-single-byte-overflow.patch # Copyright (C) 2015 The OpenSDE Project # # More information can be found in the files COPYING and README. # # This patch file is dual-licensed. It is available under the license the # patched project is licensed under, as long as it is an OpenSource license # as defined at http://www.opensource.org/ (e.g. BSD, X11) or under the terms # of the GNU General Public License as published by the Free Software # Foundation; either version 2 of the License, or (at your option) any later # version. # --- SDE-COPYRIGHT-NOTE-END --- From b114190b29417fff6f701eea3a3b3b6030338280 Mon Sep 17 00:00:00 2001 From: Rich Felker Date: Sat, 24 Oct 2015 22:42:10 -0400 Subject: fix single-byte overflow of malloc'd buffer in getdelim the buffer enlargement logic here accounted for the terminating null byte, but not for the possibility of hitting the delimiter in the buffer-refill code path that uses getc_unlocked, in which case two additional bytes (the delimiter and the null termination) are written without another chance to enlarge the buffer. this patch and the corresponding bug report are by Felix Janda. --- src/stdio/getdelim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/stdio/getdelim.c b/src/stdio/getdelim.c index a88c393..3077490 100644 --- a/src/stdio/getdelim.c +++ b/src/stdio/getdelim.c @@ -27,7 +27,7 @@ ssize_t getdelim(char **restrict s, size_t *restrict n, int delim, FILE *restric for (;;) { z = memchr(f->rpos, delim, f->rend - f->rpos); k = z ? z - f->rpos + 1 : f->rend - f->rpos; - if (i+k >= *n) { + if (i+k+1 >= *n) { if (k >= SIZE_MAX/2-i) goto oom; *n = i+k+2; if (*n < SIZE_MAX/4) *n *= 2; -- cgit v0.11.2