[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <1380272082-13878-1-git-send-email-mforney@mforney.org>
Date: Fri, 27 Sep 2013 01:54:42 -0700
From: Michael Forney <mforney@...rney.org>
To: musl@...ts.openwall.com
Subject: [PATCH] mbsrtowcs: Fix bug when wn is a multiple of 4
If wn becomes 0 after processing a chunk of 4, mbsrtowcs currently
continues on, wrapping wn around to -1, causing the rest of the string
to be processed.
This resulted in buffer overruns if there was only space in ws for wn
wide characters.
---
Hi,
I found this bug while tracking down a SIGSEGV in bash when globbing a large
pattern.
src/multibyte/mbsrtowcs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/multibyte/mbsrtowcs.c b/src/multibyte/mbsrtowcs.c
index b9bbc33..c5a30de 100644
--- a/src/multibyte/mbsrtowcs.c
+++ b/src/multibyte/mbsrtowcs.c
@@ -66,6 +66,7 @@ resume0:
*ws++ = *s++;
wn -= 4;
}
+ if (!wn) continue;
}
if (*s-1u < 0x7f) {
*ws++ = *s++;
--
1.8.4
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
