* [PATCH] path: fix 1 byte overflow with empty lists
@ 2011-11-06 4:46 Mike Frysinger
2011-11-07 15:14 ` Bill Kendall
0 siblings, 1 reply; 2+ messages in thread
From: Mike Frysinger @ 2011-11-06 4:46 UTC (permalink / raw)
To: xfs; +Cc: aelder
If pap->pa_cnt is 0, then the local buffer is allocated as 1 byte,
but the code then writes two bytes to it '/' and '\0'.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
---
common/path.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/common/path.c b/common/path.c
index 66320de..ca24f6a 100644
--- a/common/path.c
+++ b/common/path.c
@@ -285,6 +285,8 @@ pa_gen( pa_t *pap )
for ( i = 0 ; i < pap->pa_cnt ; i++ ) {
sz += strlen( pap->pa_array[ i ] ) + 1;
}
+ if ( i == 0 )
+ sz++;
sz++;
retp = ( char * )malloc( sz );
--
1.7.6.1
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] path: fix 1 byte overflow with empty lists
2011-11-06 4:46 [PATCH] path: fix 1 byte overflow with empty lists Mike Frysinger
@ 2011-11-07 15:14 ` Bill Kendall
0 siblings, 0 replies; 2+ messages in thread
From: Bill Kendall @ 2011-11-07 15:14 UTC (permalink / raw)
To: Mike Frysinger; +Cc: xfs
On 11/05/2011 11:46 PM, Mike Frysinger wrote:
> If pap->pa_cnt is 0, then the local buffer is allocated as 1 byte,
> but the code then writes two bytes to it '/' and '\0'.
>
> Signed-off-by: Mike Frysinger<vapier@gentoo.org>
Looks good,
Reviewed-by: Bill Kendall <wkendall@sgi.com>
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-11-07 15:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-11-06 4:46 [PATCH] path: fix 1 byte overflow with empty lists Mike Frysinger
2011-11-07 15:14 ` Bill Kendall
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox