You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
48 lines
1.8 KiB
48 lines
1.8 KiB
# --- SDE-COPYRIGHT-NOTE-BEGIN ---
|
|
# This copyright note is auto-generated by ./scripts/Create-CopyPatch.
|
|
#
|
|
# Filename: package/.../musl/fix-single-byte-overflow.patch
|
|
# Copyright (C) 2015 The OpenSDE Project
|
|
#
|
|
# More information can be found in the files COPYING and README.
|
|
#
|
|
# This patch file is dual-licensed. It is available under the license the
|
|
# patched project is licensed under, as long as it is an OpenSource license
|
|
# as defined at http://www.opensource.org/ (e.g. BSD, X11) or under the terms
|
|
# of the GNU General Public License as published by the Free Software
|
|
# Foundation; either version 2 of the License, or (at your option) any later
|
|
# version.
|
|
# --- SDE-COPYRIGHT-NOTE-END ---
|
|
|
|
From b114190b29417fff6f701eea3a3b3b6030338280 Mon Sep 17 00:00:00 2001
|
|
From: Rich Felker <dalias@aerifal.cx>
|
|
Date: Sat, 24 Oct 2015 22:42:10 -0400
|
|
Subject: fix single-byte overflow of malloc'd buffer in getdelim
|
|
|
|
the buffer enlargement logic here accounted for the terminating null
|
|
byte, but not for the possibility of hitting the delimiter in the
|
|
buffer-refill code path that uses getc_unlocked, in which case two
|
|
additional bytes (the delimiter and the null termination) are written
|
|
without another chance to enlarge the buffer.
|
|
|
|
this patch and the corresponding bug report are by Felix Janda.
|
|
---
|
|
src/stdio/getdelim.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/stdio/getdelim.c b/src/stdio/getdelim.c
|
|
index a88c393..3077490 100644
|
|
--- a/src/stdio/getdelim.c
|
|
+++ b/src/stdio/getdelim.c
|
|
@@ -27,7 +27,7 @@ ssize_t getdelim(char **restrict s, size_t *restrict n, int delim, FILE *restric
|
|
for (;;) {
|
|
z = memchr(f->rpos, delim, f->rend - f->rpos);
|
|
k = z ? z - f->rpos + 1 : f->rend - f->rpos;
|
|
- if (i+k >= *n) {
|
|
+ if (i+k+1 >= *n) {
|
|
if (k >= SIZE_MAX/2-i) goto oom;
|
|
*n = i+k+2;
|
|
if (*n < SIZE_MAX/4) *n *= 2;
|
|
--
|
|
cgit v0.11.2
|
|
|