|
Message-ID: <20210710165050.GU13220@brightrain.aerifal.cx> Date: Sat, 10 Jul 2021 12:50:50 -0400 From: Rich Felker <dalias@...c.org> To: jason <jason@...omnia247.nl> Cc: musl@...ts.openwall.com Subject: Re: Bug in src/stdio/fread.c On Sat, Jul 10, 2021 at 03:10:26PM +0200, jason wrote: > If you look at the code: > > size_t fread(void *restrict destv, size_t size, size_t nmemb, FILE *restrict f) > { > unsigned char *dest = destv; > size_t len = size*nmemb, l = len, k; > if (!size) nmemb = 0; > > FLOCK(f); > > f->mode |= f->mode-1; > > if (f->rpos != f->rend) { > /* First exhaust the buffer. */ > k = MIN(f->rend - f->rpos, l); > memcpy(dest, f->rpos, k); > f->rpos += k; > dest += k; > l -= k; > } > > /* Read the remainder directly */ > for (; l; l-=k, dest+=k) { > k = __toread(f) ? 0 : f->read(f, dest, l); > if (!k) { > FUNLOCK(f); > return (len-l)/size; > } > } > > FUNLOCK(f); > return nmemb; > } > > Consider what happens when f->rpos == f->rend: k is used uninitialized. At which line? Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.