[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180916182542.GB17995@brightrain.aerifal.cx>
Date: Sun, 16 Sep 2018 14:25:42 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Cc: Felix Janda <felix.janda@...teo.de>
Subject: Re: [PATCH] Fix off-by-one buffer overflow in getdelim
On Sat, Oct 24, 2015 at 10:43:39PM +0200, Felix Janda wrote:
> when deciding whether to resize the buffer, the terminating null byte
> was not taken into account
> ---
> src/stdio/getdelim.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/stdio/getdelim.c b/src/stdio/getdelim.c
> index a88c393..3077490 100644
> --- a/src/stdio/getdelim.c
> +++ b/src/stdio/getdelim.c
> @@ -27,7 +27,7 @@ ssize_t getdelim(char **restrict s, size_t *restrict n, int delim, FILE *restric
> for (;;) {
> z = memchr(f->rpos, delim, f->rend - f->rpos);
> k = z ? z - f->rpos + 1 : f->rend - f->rpos;
> - if (i+k >= *n) {
> + if (i+k+1 >= *n) {
> if (k >= SIZE_MAX/2-i) goto oom;
> *n = i+k+2;
> if (*n < SIZE_MAX/4) *n *= 2;
> --
> 2.4.9
This patch raised a potential conformance issue, that by a strict
reading of the spec, getdelim is only permitted to realloc if the
caller-provided buffer length is insufficient:
"If *lineptr is a null pointer or if the object pointed to by
*lineptr is of insufficient size, an object shall be allocated as
if by malloc() or the object shall be reallocated as if by
realloc(), respectively, ..."
I'm going to change the +1 to +!z and add a comment. The idea is that
the +1 was only needed in order for the result to fit if the delimiter
has not already been found; if the memchr found it, an exact-sized
buffer was being expanded unnecessarily.
I'm replying to this thread and CC'ing in case there are any problems
I'm missing in my new fix.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
