diff options
author | Rich Felker <dalias@aerifal.cx> | 2013-09-27 13:09:46 -0400 |
---|---|---|
committer | Rich Felker <dalias@aerifal.cx> | 2013-09-27 13:09:46 -0400 |
commit | 211264e46a2f1bc382a84435e904d1548de672b0 (patch) | |
tree | 86c29e9aabbcc1b713cfc2da388fc0c928a1ce1c /src/dirent | |
parent | e1f1df9c743af60c0e6271fcd78b59dbfd72d8ad (diff) | |
download | musl-211264e46a2f1bc382a84435e904d1548de672b0.tar.gz musl-211264e46a2f1bc382a84435e904d1548de672b0.tar.xz musl-211264e46a2f1bc382a84435e904d1548de672b0.zip |
fix buffer overflow in mbsrtowcs
issue reported by Michael Forney: "If wn becomes 0 after processing a chunk of 4, mbsrtowcs currently continues on, wrapping wn around to -1, causing the rest of the string to be processed. This resulted in buffer overruns if there was only space in ws for wn wide characters." the original patch submitted added an additional check for !wn after the loop; to avoid extra branching, I instead just changed the wn>=4 check to wn>=5 to ensure that at least one slot remains after the word-at-a-time loop runs. this should not slow down the tail processing on real-world usage, since an extra slot that can't be processed in the word-at-a-time loop is needed for the null termination anyway.
Diffstat (limited to 'src/dirent')
0 files changed, 0 insertions, 0 deletions