[PATCH] stdio-common: Fix overflow registering modifier [BZ #34086]

Rocket Ma marocketbd@gmail.com
Thu Apr 23 16:09:23 GMT 2026


* stdio-common/reg-modifier.c: The wchar in str can be greater or equal
than 0, and less or equal than UCHAR_MAX, that means, we need a buffer
with UCHAR_MAX + 1 elements, so that user input will not overflow
__printf_modifier_table.

Signed-off-by: Rocket Ma <marocketbd@gmail.com>
---
 stdio-common/reg-modifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stdio-common/reg-modifier.c b/stdio-common/reg-modifier.c
index 60d0521527..367f482bd5 100644
--- a/stdio-common/reg-modifier.c
+++ b/stdio-common/reg-modifier.c
@@ -66,7 +66,7 @@ __register_printf_modifier (const wchar_t *str)
 
   if (__printf_modifier_table == NULL)
     {
-      __printf_modifier_table = calloc (UCHAR_MAX,
+      __printf_modifier_table = calloc (UCHAR_MAX + 1,
 					sizeof (*__printf_modifier_table));
       if (__printf_modifier_table == NULL)
 	goto out;
-- 
2.54.0



More information about the Libc-alpha mailing list