[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260805114936.GL3520958@port70.net>
Date: Wed, 5 Aug 2026 13:49:36 +0200
From: Szabolcs Nagy <nsz@...t70.net>
To: Matthias Goergens <matthias.goergens@...il.com>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH] fix undefined pointer arithmetic in wcsrchr
* Matthias Goergens <matthias.goergens@...il.com> [2026-08-05 15:57:55 +0800]:
> On an unsuccessful search, the backwards loop decrements the pointer
> past the beginning of the string and then compares that invalid pointer
> with the string pointer.
>
> Check for the beginning of the string before decrementing instead. This
> preserves the existing results without forming a pointer outside the
> array.
looks ok
fixes a theoretical ub (unlikely to cause trouble in practice)
how did you find this?
> ---
> src/string/wcsrchr.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/src/string/wcsrchr.c b/src/string/wcsrchr.c
> index 8961b9e2..aef344b4 100644
> --- a/src/string/wcsrchr.c
> +++ b/src/string/wcsrchr.c
> @@ -3,6 +3,10 @@
> wchar_t *wcsrchr(const wchar_t *s, wchar_t c)
> {
> const wchar_t *p;
> - for (p=s+wcslen(s); p>=s && *p!=c; p--);
> - return p>=s ? (wchar_t *)p : 0;
> + p = s+wcslen(s);
> + while (*p != c) {
> + if (p == s) return 0;
> + p--;
> + }
> + return (wchar_t *)p;
> }
> --
> 2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
