diff options
| author | Tavian Barnes <tavianator@tavianator.com> | 2023-09-06 14:59:59 -0400 |
|---|---|---|
| committer | Tavian Barnes <tavianator@tavianator.com> | 2023-09-06 16:31:04 -0400 |
| commit | 377709664480a30fa5acdd11c7ca8c16669678ce (patch) | |
| tree | 3478c5b632658c9babb23c48406f082fb178d400 /src/bfstd.c | |
| parent | 37dd040e04bd23293b6e46f8f5af22ea07717894 (diff) | |
| download | bfs-377709664480a30fa5acdd11c7ca8c16669678ce.tar.xz | |
bfstd: Fix an OOB string index in xmbrtowc()
This bug could be reproduced with something like
$ bfs -samefile $'\xFA\xFA'
bfs: error: bfs: dstrnescat@src/dstring.c:252: wordesc() result truncated
or worse, with -DNDEBUG,
$ bfs -samefile $'.....................\xFA\xFA'
bfs: error: bfs -samefile $'.....................\xFA\xFA\x00\x55\x53\x45\x52\x3D\x74\x61\x76\x69\x61\x6E\x61\x74\x6F\x72
bfs: error: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
bfs: error: No such file or directory.
which prints the memory after the end of the string (in this case, the
environment variable USER=tavianator).
The bug was caused by the line `*i += len`, which was intended to be
`*i = len`. But actually, the right behaviour seems to be `*i += 1`.
Fixes: 19c96abe0a1ee56cf206fd5e87defb1fd3e0daa5
Diffstat (limited to 'src/bfstd.c')
| -rw-r--r-- | src/bfstd.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/src/bfstd.c b/src/bfstd.c index e546a47..2d9f60a 100644 --- a/src/bfstd.c +++ b/src/bfstd.c @@ -546,15 +546,11 @@ int xstrtofflags(const char **str, unsigned long long *set, unsigned long long * static int xmbrtowc(wchar_t *wc, size_t *i, const char *str, size_t len, mbstate_t *mb) { size_t mblen = mbrtowc(wc, str + *i, len - *i, mb); switch (mblen) { - case -1: - // Invalid byte sequence + case -1: // Invalid byte sequence + case -2: // Incomplete byte sequence *i += 1; memset(mb, 0, sizeof(*mb)); return -1; - case -2: - // Incomplete byte sequence - *i += len; - return -1; default: *i += mblen; return 0; |