From c51f05c59799fd03b15874a9608e613315dcb11c Mon Sep 17 00:00:00 2001 From: Keith Packard Date: Mon, 11 Oct 2021 09:24:54 -0700 Subject: [PATCH] string: Fix buffer overrun in picolibc/newlib/libc/string/strrchr.c (#184) Reported by prodisDown: In picolibc/newlib/libc/string/strrchr.c if (i) { while ((s=strchr(s, i))) { last = s; s++; } } else { last = strchr(s, i); } Value (for example 0xFFFFFF00) in if (i) can pass test and then be typecasted to char inside strchr(). Then s++ and then buffer overrun. It can be fixed by preventive typecast i = (int) (char) i; or typecasting inside expression if ((char) i). Fixed by casting to char. Signed-off-by: Keith Packard --- newlib/libc/string/strrchr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/newlib/libc/string/strrchr.c b/newlib/libc/string/strrchr.c index 04897e162..35a7060d2 100644 --- a/newlib/libc/string/strrchr.c +++ b/newlib/libc/string/strrchr.c @@ -34,10 +34,11 @@ strrchr (const char *s, int i) { const char *last = NULL; + char c = i; - if (i) + if (c) { - while ((s=strchr(s, i))) + while ((s=strchr(s, c))) { last = s; s++; @@ -45,8 +46,8 @@ strrchr (const char *s, } else { - last = strchr(s, i); + last = strchr(s, c); } - + return (char *) last; } -- 2.43.5