| 1 | From 478effbfd9c3cc5a627fc671d4bf94d13670d65f Mon Sep 17 00:00:00 2001 |
| 2 | From: Jeremy Harris <jgh146exb@wizmail.org> |
| 3 | Date: Fri, 27 Sep 2019 12:21:49 +0100 |
| 4 | Subject: [PATCH] Fix buffer overflow in string_vformat. Bug 2449 |
| 5 | |
| 6 | --- |
| 7 | src/string.c | 4 ++-- |
| 8 | test/scripts/0000-Basic/0214 | 11 +++++++++++ |
| 9 | test/stdout/0214 | 7 +++++++ |
| 10 | 3 files changed, 20 insertions(+), 2 deletions(-) |
| 11 | |
| 12 | diff --git a/src/string.c b/src/string.c |
| 13 | index c6549bf93..3445f8a42 100644 |
| 14 | --- a/src/string.c |
| 15 | +++ b/src/string.c |
| 16 | @@ -1132,7 +1132,7 @@ store_reset(g->s + (g->size = g->ptr + 1)); |
| 17 | Arguments: |
| 18 | g the growable-string |
| 19 | p current end of data |
| 20 | - count amount to grow by |
| 21 | + count amount to grow by, offset from p |
| 22 | */ |
| 23 | |
| 24 | static void |
| 25 | @@ -1590,7 +1590,7 @@ while (*fp) |
| 26 | } |
| 27 | else if (g->ptr >= lim - width) |
| 28 | { |
| 29 | - gstring_grow(g, g->ptr, width - (lim - g->ptr)); |
| 30 | + gstring_grow(g, g->ptr, width); |
| 31 | lim = g->size - 1; |
| 32 | gp = CS g->s + g->ptr; |
| 33 | } |
| 34 | -- |
| 35 | 2.23.0 |
| 36 | |