]> sourceware.org Git - newlib-cygwin.git/commit
string: Fix buffer overrun in picolibc/newlib/libc/string/strrchr.c (#184)
authorKeith Packard <keithp@keithp.com>
Mon, 11 Oct 2021 16:24:54 +0000 (09:24 -0700)
committerJeff Johnston <jjohnstn@redhat.com>
Wed, 13 Oct 2021 20:39:49 +0000 (16:39 -0400)
commitc51f05c59799fd03b15874a9608e613315dcb11c
tree68f431702b12ce8441ba72c485dc1a6dbb506122
parentdcd564f65caa96a9dc5c0d17020b9674a1a36e32
string: Fix buffer overrun in picolibc/newlib/libc/string/strrchr.c (#184)

Reported by prodisDown:

In picolibc/newlib/libc/string/strrchr.c

if (i) { while ((s=strchr(s, i))) { last = s; s++; } } else { last = strchr(s, i); }

Value (for example 0xFFFFFF00) in if (i) can pass test and
then be typecasted to char inside strchr(). Then s++ and then
buffer overrun.

It can be fixed by preventive typecast i = (int) (char) i; or
typecasting inside expression if ((char) i).

Fixed by casting to char.

Signed-off-by: Keith Packard <keithp@keithp.com>
newlib/libc/string/strrchr.c
This page took 0.030141 seconds and 5 git commands to generate.