AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-09 23:00:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix out of bounds access in findidxwc (bug 23442)

Browse Source 
If usrc is a prefix of cp but one character shorter an out of bounds
access to usrc was done.
This commit is contained in:
Andreas Schwab 2018-07-24 18:02:28 +02:00
parent 969c335506
commit 9c79cec8cd
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2018-07-25 Andreas Schwab <schwab@suse.de>
[BZ #23442]
* locale/weightwc.h (findidx): Handle the case where usrc is a
prefix of cp but one character too short.
2018-07-24 Adhemerval Zanella <adhemerval.zanella@linaro.org>
* NEWS: Add ISO C threads addition.

6
locale/weightwc.h
View File

@ -109,7 +109,7 @@ findidx (const int32_t *table,
break;
DIAG_POP_NEEDS_COMMENT;
if (cnt < nhere - 1)
if (cnt < nhere - 1 || cnt == len)
{
cp += 2 * nhere;
continue;
@ -121,14 +121,14 @@ findidx (const int32_t *table,
same reason as described above. */
DIAG_PUSH_NEEDS_COMMENT;
DIAG_IGNORE_Os_NEEDS_COMMENT (7, "-Wmaybe-uninitialized");
if (cp[nhere - 1] > usrc[nhere -1])
if (cp[nhere - 1] > usrc[nhere - 1])
{
cp += 2 * nhere;
continue;
}
DIAG_POP_NEEDS_COMMENT;
if (cp[2 * nhere - 1] < usrc[nhere -1])
if (cp[2 * nhere - 1] < usrc[nhere - 1])
{
cp += 2 * nhere;
continue;