[PATCH] iniparser: prevent signed integer underflow in line length calculation

[PATCH] iniparser: prevent signed integer underflow in line length calculation

[Anton Moryakov]

In iniparser_load_file(), the code computed:
    len = (int)strlen(line) - 1;
If the input line was empty (e.g. started with a null byte), strlen()
returned 0, leading to len = -1. This caused:
  - A signed integer underflow (detected by static analyzers)
  - Potential out-of-bounds access when checking line[len]

Fix by:
  - Using size_t for strlen() result
  - Checking for zero length before subtraction
  - Computing len as (int)(line_len - 1) only when safe

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
---
 lib/libiniparser.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/libiniparser.c b/lib/libiniparser.c
index 4b21b34..1d6dbac 100644
--- a/lib/libiniparser.c
+++ b/lib/libiniparser.c
@@ -697,7 +697,13 @@ dictionary * iniparser_load_file(FILE * in, const char * ininame)
 
     while (fgets(line+last, ASCIILINESZ-last, in)!=NULL) {
         lineno++ ;
-        len = (int)strlen(line)-1;
+        size_t line_len = strlen(line);
+                if (line_len == 0) {
+            memset(line, 0, ASCIILINESZ);
+            last = 0;
+            continue;
+        }
+        len = (int)(line_len - 1);
         if (len<=0)
             continue;
         /* Safety check against buffer overflows */
-- 
2.39.2


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/