From b866018f54ad0670ee9b930a14ae6e8960b9f4bf Mon Sep 17 00:00:00 2001 From: Szabolcs Nagy Date: Tue, 11 Oct 2022 14:57:16 +0100 Subject: Fix missing NUL terminator in stdio-common/scanf13 test sscanf is only defined on nul terminated string input, but '\0' was missing in this test which caused _IO_str_init_static_internal to read OOB on the stack when computing the bounds of the string. Reviewed-by: Florian Weimer --- stdio-common/scanf13.c | 1 + 1 file changed, 1 insertion(+) (limited to 'stdio-common') diff --git a/stdio-common/scanf13.c b/stdio-common/scanf13.c index 720224aa05..60aa62a26f 100644 --- a/stdio-common/scanf13.c +++ b/stdio-common/scanf13.c @@ -67,6 +67,7 @@ main (void) buf[2049] = 0x84; buf[2058] = '\t'; buf[2059] = 'a'; + buf[sizeof (buf) - 1] = '\0'; if (sscanf (buf, "%ms%mc", &sp1, &sp2) != 2) FAIL (); else -- cgit 1.4.1