[PATCH] getmntent: fix memory corruption w/blank lines [BZ #18887]
Ondřej Bílka
neleai@seznam.cz
Sat Aug 29 05:50:00 GMT 2015
On Fri, Aug 28, 2015 at 05:22:41PM -0400, Mike Frysinger wrote:
> The fix for BZ #17273 added introduced a single byte of memory corruption
> when the line is entirely blank. It would walk back past the start of the
> buffer if the heap happened to be 0x20 or 0x09 and then write a NUL byte.
> buffer = '\n';
> end_ptr = buffer;
> while (end_ptr[-1] == ' ' || end_ptr[-1] == '\t')
> end_ptr--;
> *end_ptr = '\0';
>
> Fix that and rework the tests. Adding the testcase for BZ #17273 does
> not really make sense as it's unrelated, and leads to confusing behavior:
> it implicitly relies on the new entry being written to the start of the
> file being longer than the previous entry since there is no truncation.
> Instead split it out into its own dedicated testcase.
>
looks ok.
More information about the Libc-alpha
mailing list