[<prev] [day] [month] [year] [list]
Message-ID: <20260510043910.15465-1-mailto.luca.kellermann@gmail.com>
Date: Sun, 10 May 2026 06:34:20 +0200
From: Luca Kellermann <mailto.luca.kellermann@...il.com>
To: musl@...ts.openwall.com
Subject: [PATCH] fix integer overflow in gai_strerror, hstrerror and regerror
at least gai_strerror() and regerror() are specified to accept any int
value. if the value was close to INT_MAX (for gai_strerror()) or
INT_MIN (for hstrerror() and regerror()) a signed integer overflow
would occur.
fix this by converting the int argument to unsigned before doing
arithmetic.
---
src/network/gai_strerror.c | 3 ++-
src/network/hstrerror.c | 3 ++-
src/regex/regerror.c | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/src/network/gai_strerror.c b/src/network/gai_strerror.c
index 56b71503134090f280d8385e720bf35d3e01cf6c..78e49f921fa00e9455b84d34d1a6b62f3d65f0b9 100644
--- a/src/network/gai_strerror.c
+++ b/src/network/gai_strerror.c
@@ -14,12 +14,13 @@ static const char msgs[] =
"Out of memory\0"
"System error\0"
"Overflow\0"
"\0Unknown error";
-const char *gai_strerror(int ecode)
+const char *gai_strerror(int e)
{
const char *s;
+ unsigned ecode=e;
for (s=msgs, ecode++; ecode && *s; ecode++, s++) for (; *s; s++);
if (!*s) s++;
return LCTRANS_CUR(s);
}
diff --git a/src/network/hstrerror.c b/src/network/hstrerror.c
index a4d001c53410a0faeee07d5e7e93ec62a917d027..a17a8e0a2402c7c40fe910e007d349f6224ed8c1 100644
--- a/src/network/hstrerror.c
+++ b/src/network/hstrerror.c
@@ -7,12 +7,13 @@ static const char msgs[] =
"Try again\0"
"Non-recoverable error\0"
"Address not available\0"
"\0Unknown error";
-const char *hstrerror(int ecode)
+const char *hstrerror(int e)
{
const char *s;
+ unsigned ecode=e;
for (s=msgs, ecode--; ecode && *s; ecode--, s++) for (; *s; s++);
if (!*s) s++;
return LCTRANS_CUR(s);
}
diff --git a/src/regex/regerror.c b/src/regex/regerror.c
index 5b347cc73c7351b72ec40efa4901818751da7019..5e35870f0787f5daddf79466b92b9951dca9c995 100644
--- a/src/regex/regerror.c
+++ b/src/regex/regerror.c
@@ -25,13 +25,14 @@ static const char messages[] = {
"Out of memory\0"
"Repetition not preceded by valid expression\0"
"\0Unknown error"
};
-size_t regerror(int e, const regex_t *restrict preg, char *restrict buf, size_t size)
+size_t regerror(int c, const regex_t *restrict preg, char *restrict buf, size_t size)
{
const char *s;
+ unsigned e=c;
for (s=messages; e && *s; e--, s+=strlen(s)+1);
if (!*s) s++;
s = LCTRANS_CUR(s);
return 1+snprintf(buf, size, "%s", s);
}
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
