diff options
| author | Rich Felker <dalias@aerifal.cx> | 2024-02-12 17:35:48 -0500 |
|---|---|---|
| committer | Rich Felker <dalias@aerifal.cx> | 2024-02-16 09:33:03 -0500 |
| commit | 4a16ddf53e7c634169d0a649782f8a724611f263 (patch) | |
| tree | f473d01ff9b0d9e57516533e98846e87a15a1f71 | |
| parent | cf91e9b3937dc354b702c8ac1b6135bd818154ba (diff) | |
| download | musl-4a16ddf53e7c634169d0a649782f8a724611f263.tar.gz musl-4a16ddf53e7c634169d0a649782f8a724611f263.tar.xz musl-4a16ddf53e7c634169d0a649782f8a724611f263.zip | |
strftime: fix breakage in last change (uninitialized pointer access)
commit f47a5d400b8ffa26cfc5b345dbff52fec94ac7f3 overlooked that strtoul was responsible for setting p to a const-laundered copy of the format string pointer f, even in the case where there was no number to parse. by making the call conditional on isdigit, that copy was lost. the logic here is a mess and should be cleaned up, but for now, this seems to be the least invasive change that undoes the breakage.
| -rw-r--r-- | src/time/strftime.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/time/strftime.c b/src/time/strftime.c index ef590903..c40246db 100644 --- a/src/time/strftime.c +++ b/src/time/strftime.c @@ -234,7 +234,12 @@ size_t __strftime_l(char *restrict s, size_t n, const char *restrict f, const st pad = 0; if (*f == '-' || *f == '_' || *f == '0') pad = *f++; if ((plus = (*f == '+'))) f++; - width = isdigit(*f) ? strtoul(f, &p, 10) : 0; + if (isdigit(*f)) { + width = strtoul(f, &p, 10); + } else { + width = 0; + p = (void *)f; + } if (*p == 'C' || *p == 'F' || *p == 'G' || *p == 'Y') { if (!width && p!=f) width = 1; } else { |