e2afae630
Quentin Rameau
2018-04-01
Subject
sed: prevent overflow of length from bb_get_chunk_from_file
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
editors/sed.c+1 -1
| @@ -988,7 +988,7 @@ static void flush_append(char *last_puts_char) | |
| static char *get_next_line(char *gets_char, char *last_puts_char) | |
| { | |
| char *temp = NULL; | |
| - | int len; |
| + | size_t len; |
| char gc; | |
| flush_append(last_puts_char); | |
include/libbb.h+1 -1
| @@ -911,7 +911,7 @@ extern void xprint_and_close_file(FILE *file) FAST_FUNC; | |
| * end of line. If end isn't NULL, length of the chunk is stored in it. | |
| * Returns NULL if EOF/error. | |
| */ | |
| - | extern char *bb_get_chunk_from_file(FILE *file, int *end) FAST_FUNC; |
| + | extern char *bb_get_chunk_from_file(FILE *file, size_t *end) FAST_FUNC; |
| /* Reads up to (and including) TERMINATING_STRING: */ | |
| extern char *xmalloc_fgets_str(FILE *file, const char *terminating_string) FAST_FUNC RETURNS_MALLOC; | |
| /* Same, with limited max size, and returns the length (excluding NUL): */ | |
libbb/get_line_from_file.c+7 -4
| @@ -10,16 +10,19 @@ | |
| */ | |
| #include "libbb.h" | |
| - | char* FAST_FUNC bb_get_chunk_from_file(FILE *file, int *end) |
| + | char* FAST_FUNC bb_get_chunk_from_file(FILE *file, size_t *end) |
| { | |
| int ch; | |
| - | unsigned idx = 0; |
| + | size_t idx = 0; |
| char *linebuf = NULL; | |
| while ((ch = getc(file)) != EOF) { | |
| /* grow the line buffer as necessary */ | |
| - | if (!(idx & 0xff)) |
| + | if (!(idx & 0xff)) { |
| + | if (idx == ((size_t)-1) - 0xff) |
| + | bb_error_msg_and_die(bb_msg_memory_exhausted); |
| linebuf = xrealloc(linebuf, idx + 0x100); | |
| + | } |
| linebuf[idx++] = (char) ch; | |
| if (ch == '\0') | |
| break; | |
| @@ -49,7 +52,7 @@ char* FAST_FUNC xmalloc_fgets(FILE *file) | |
| /* Get line. Remove trailing \n */ | |
| char* FAST_FUNC xmalloc_fgetline(FILE *file) | |
| { | |
| - | int i; |
| + | size_t i; |
| char *c = bb_get_chunk_from_file(file, &i); | |
| if (i && c[--i] == '\n') | |