[PATCH] stdio-common: Fix overflow registering modifier [BZ #34086]
Rocket Ma
marocketbd@gmail.com
Thu Apr 23 16:09:23 GMT 2026
* stdio-common/reg-modifier.c: The wchar in str can be greater or equal
than 0, and less or equal than UCHAR_MAX, that means, we need a buffer
with UCHAR_MAX + 1 elements, so that user input will not overflow
__printf_modifier_table.
Signed-off-by: Rocket Ma <marocketbd@gmail.com>
---
stdio-common/reg-modifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/stdio-common/reg-modifier.c b/stdio-common/reg-modifier.c
index 60d0521527..367f482bd5 100644
--- a/stdio-common/reg-modifier.c
+++ b/stdio-common/reg-modifier.c
@@ -66,7 +66,7 @@ __register_printf_modifier (const wchar_t *str)
if (__printf_modifier_table == NULL)
{
- __printf_modifier_table = calloc (UCHAR_MAX,
+ __printf_modifier_table = calloc (UCHAR_MAX + 1,
sizeof (*__printf_modifier_table));
if (__printf_modifier_table == NULL)
goto out;
--
2.54.0
More information about the Libc-alpha
mailing list