[PATCH 17/20] Fix missing NUL terminator in stdio-common/scanf13 test
Florian Weimer
fweimer@redhat.com
Fri Oct 28 05:44:56 GMT 2022
* Szabolcs Nagy via Libc-alpha:
> sscanf is only defined on nul terminated string input, but '\0' was
> missing in this test which caused _IO_str_init_static_internal to
> read OOB on the stack when computing the bounds of the string.
> ---
> stdio-common/scanf13.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/stdio-common/scanf13.c b/stdio-common/scanf13.c
> index 720224aa05..60aa62a26f 100644
> --- a/stdio-common/scanf13.c
> +++ b/stdio-common/scanf13.c
> @@ -67,6 +67,7 @@ main (void)
> buf[2049] = 0x84;
> buf[2058] = '\t';
> buf[2059] = 'a';
> + buf[sizeof (buf) - 1] = '\0';
> if (sscanf (buf, "%ms%mc", &sp1, &sp2) != 2)
> FAIL ();
> else
We want this test to be correct (see bug 17577), but for now this is the
right change.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Thanks,
Florian
More information about the Libc-alpha
mailing list