Re: [kbd] Invalid out of bounds memory read when running make check

[Felix Janda <felix.janda@posteo.de>]

Subject: ksyms: Fix out of bounds memory read in codetoksym

Bug detected by Hanno Böck using asan.
---
 src/libkeymap/ksyms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libkeymap/ksyms.c b/src/libkeymap/ksyms.c
index 22b1336..3d35ead 100644
--- a/src/libkeymap/ksyms.c
+++ b/src/libkeymap/ksyms.c
@@ -197,7 +197,7 @@ codetoksym(struct lk_ctx *ctx, int code) {
 		i = ctx->charset;
 		while (1) {
 			p = (sym *) charsets[i].charnames;
-			if (p) {
+			if (p && (KVAL(code) >= charsets[i].start)) {
 				p += KVAL(code) - charsets[i].start;
 
 				if (p->name[0])
-- 
2.7.3

Hanno Böck wrote:
> Hi,
> 
> When compiling kbd (latest version 2.0.3) with address sanitizer and
> running the test suite (make check) it will show a global out of bounds
> memory read. I have attached the address sanitizer error message at the
> end of this mail.
> 
> I have not fully tracked down the bug, but the error happens in the
> file ksyms.c in line 203.
> 
> The test that's causing this can be manually run with
> ./libkeymap-dumpkeys ./dumpkeys.ua-ws.map SEPARATE_LINE FALSE
> in the tests dir.
> 
> This line from dumpkeys.ua-ws.map causes it:
> altgr keycode   3 = 157
> 
> To reproduce:
> ./configure CFLAGS="-fsanitize=address -g" LDFLAGS="-fsanitize=address"
> make
> make check

It segfaults for me on a musl based system without asan. I think that
the patch above should fix it.

Felix