Commit | Line | Data |
---|---|---|
01e60269 AM |
1 | From 478effbfd9c3cc5a627fc671d4bf94d13670d65f Mon Sep 17 00:00:00 2001 |
2 | From: Jeremy Harris <jgh146exb@wizmail.org> | |
3 | Date: Fri, 27 Sep 2019 12:21:49 +0100 | |
4 | Subject: [PATCH] Fix buffer overflow in string_vformat. Bug 2449 | |
5 | ||
6 | --- | |
7 | src/string.c | 4 ++-- | |
8 | test/scripts/0000-Basic/0214 | 11 +++++++++++ | |
9 | test/stdout/0214 | 7 +++++++ | |
10 | 3 files changed, 20 insertions(+), 2 deletions(-) | |
11 | ||
12 | diff --git a/src/string.c b/src/string.c | |
13 | index c6549bf93..3445f8a42 100644 | |
14 | --- a/src/string.c | |
15 | +++ b/src/string.c | |
16 | @@ -1132,7 +1132,7 @@ store_reset(g->s + (g->size = g->ptr + 1)); | |
17 | Arguments: | |
18 | g the growable-string | |
19 | p current end of data | |
20 | - count amount to grow by | |
21 | + count amount to grow by, offset from p | |
22 | */ | |
23 | ||
24 | static void | |
25 | @@ -1590,7 +1590,7 @@ while (*fp) | |
26 | } | |
27 | else if (g->ptr >= lim - width) | |
28 | { | |
29 | - gstring_grow(g, g->ptr, width - (lim - g->ptr)); | |
30 | + gstring_grow(g, g->ptr, width); | |
31 | lim = g->size - 1; | |
32 | gp = CS g->s + g->ptr; | |
33 | } | |
34 | -- | |
35 | 2.23.0 | |
36 |