[newlib-cygwin/main] Protect strcat from accessing an unaligend long pointer

Corinna Vinschen corinna@sourceware.org
Wed Feb 12 09:35:14 GMT 2025


https://sourceware.org/git/gitweb.cgi?p=newlib-cygwin.git;h=59891375d74e8e08a89ffe2e0dcd8145e18c7eb5

commit 59891375d74e8e08a89ffe2e0dcd8145e18c7eb5
Author:     Alexey Lapshin <alexey.lapshin@espressif.com>
AuthorDate: Wed Feb 12 03:14:47 2025 +0000
Commit:     Corinna Vinschen <corinna@vinschen.de>
CommitDate: Wed Feb 12 10:25:24 2025 +0100

    Protect strcat from accessing an unaligend long pointer
    
    - related to Bug libc/32679

Diff:
---
 newlib/libc/string/strcat.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/newlib/libc/string/strcat.c b/newlib/libc/string/strcat.c
index 47c53a5d2124..e213e2d91d30 100644
--- a/newlib/libc/string/strcat.c
+++ b/newlib/libc/string/strcat.c
@@ -54,15 +54,18 @@ strcat (char *__restrict s1,
   while (UNALIGNED_X(s1) && *s1)
     s1++;
 
-  /* Skip over the aligned data in s1 as quickly as possible.  */
-  unsigned long *aligned_s1 = (unsigned long *)s1;
-  while (!DETECT_NULL(*aligned_s1))
-    aligned_s1++;
-  s1 = (char *)aligned_s1;
-
-  /* Find string terminator.  */
-  while (*s1)
-    s1++;
+  if (*s1)
+    {
+      /* Skip over the aligned data in s1 as quickly as possible.  */
+      unsigned long *aligned_s1 = (unsigned long *)s1;
+      while (!DETECT_NULL(*aligned_s1))
+        aligned_s1++;
+      s1 = (char *)aligned_s1;
+
+      /* Find string terminator.  */
+      while (*s1)
+        s1++;
+    }
 
   /* s1 now points to the its trailing null character, we can
      just use strcpy to do the work for us now.


More information about the Newlib-cvs mailing list