diff options
| author | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2022-10-11 14:57:16 +0100 |
|---|---|---|
| committer | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2022-11-22 14:24:26 +0000 |
| commit | 69ecb7b4a3287e814d315e0bab05705be4d9a010 (patch) | |
| tree | 4a9f572d63ad2b533f2bb79dfdff9508b6f5cd4d /stdio-common/scanf13.c | |
| parent | 2a287534c18a37536141e94dc98685a4ce10f89f (diff) | |
| download | glibc-69ecb7b4a3287e814d315e0bab05705be4d9a010.tar.gz glibc-69ecb7b4a3287e814d315e0bab05705be4d9a010.tar.xz glibc-69ecb7b4a3287e814d315e0bab05705be4d9a010.zip | |
Fix missing NUL terminator in stdio-common/scanf13 test
sscanf is only defined on nul terminated string input, but '\0' was missing in this test which caused _IO_str_init_static_internal to read OOB on the stack when computing the bounds of the string.
Diffstat (limited to 'stdio-common/scanf13.c')
| -rw-r--r-- | stdio-common/scanf13.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/stdio-common/scanf13.c b/stdio-common/scanf13.c index 720224aa05..60aa62a26f 100644 --- a/stdio-common/scanf13.c +++ b/stdio-common/scanf13.c @@ -67,6 +67,7 @@ main (void) buf[2049] = 0x84; buf[2058] = '\t'; buf[2059] = 'a'; + buf[sizeof (buf) - 1] = '\0'; if (sscanf (buf, "%ms%mc", &sp1, &sp2) != 2) FAIL (); else |