[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <DMSEUNKU8ROG.X2TTI5TWHLXR@trevorgross.com>
Date: Wed, 11 Nov 2026 13:20:12 +0000
From: "Trevor Gross" <tg@...vorgross.com>
To: <musl@...ts.openwall.com>
Subject: Possible out of bounds read in memchr
Hello,
The C spec for `memchr` states:
> The memchr generic function locates the first occurrence of c
> (converted to an unsigned char) in the initial n characters (each
> interpreted as unsigned char) of the object pointed to by s. The
> implementation shall behave as if it reads the characters sequentially
> and stops as soon as a matching character is found.
The last bit implies that the provided length parameter is allowed to
exceed the actual length of the buffer and the implementation must not
read out of bounds. However, if I'm reading correctly, it appears that
there is a `size_t`-sized read of `w` at [1], which may be partially out
of bounds if the needle exists early in that word. Sample:
int len = 2;
char *s = malloc(len);
memset(s, 0, len);
s[1] = 1;
r = memchr(s, 1, 1024);
AddressSanitizer corroborates the issue, see [2].
Sending to the public list because this is unlikely to be problematic
and already has some public discussion (Rust Zulip).
- Trevor
[1]: https://git.musl-libc.org/cgit/musl/tree/src/string/memchr.c?id=7813e9119eb5fe681b6750b8a033a0490bca0941#n21
[2]: https://c.godbolt.org/z/vd5W78689
View attachment "text_html_8566301510856606252" of type "text/html" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
