debian/patches/78_02-Fix-buffer-overflow-in-string_vformat.-Bug-2449.patch

   1 From 478effbfd9c3cc5a627fc671d4bf94d13670d65f Mon Sep 17 00:00:00 2001
   2 From: Jeremy Harris <jgh146exb@wizmail.org>
   3 Date: Fri, 27 Sep 2019 12:21:49 +0100
   4 Subject: [PATCH] Fix buffer overflow in string_vformat.  Bug 2449
   5
   6 ---
   7  src/string.c             |  4 ++--
   8  test/scripts/0000-Basic/0214 | 11 +++++++++++
   9  test/stdout/0214             |  7 +++++++
  10  3 files changed, 20 insertions(+), 2 deletions(-)
  11
  12 diff --git a/src/string.c b/src/string.c
  13 index c6549bf93..3445f8a42 100644
  14 --- a/src/string.c
  15 +++ b/src/string.c
  16 @@ -1132,7 +1132,7 @@ store_reset(g->s + (g->size = g->ptr + 1));
  17  Arguments:
  18    g            the growable-string
  19    p            current end of data
  20 -  count                amount to grow by
  21 +  count                amount to grow by, offset from p
  22  */
  23
  24  static void
  25 @@ -1590,7 +1590,7 @@ while (*fp)
  26         }
  27        else if (g->ptr >= lim - width)
  28         {
  29 -       gstring_grow(g, g->ptr, width - (lim - g->ptr));
  30 +       gstring_grow(g, g->ptr, width);
  31         lim = g->size - 1;
  32         gp = CS g->s + g->ptr;
  33         }
  34 --
  35 2.23.0
  36