[PATCH] avoid memory overrun in a test leading to potential double-free

[PATCH] avoid memory overrun in a test leading to potential double-free

[Jim Meyering]

I ran "make check" and was dismayed to see that glibc detected a
double-free.  At first I thought it must be my fault, since I'd been
removing useless tests before free, but no...

Running "valgrind ./test-expandargv" confirmed it:

  ==29710== Conditional jump or move depends on uninitialised value(s)
  ==29710==    at 0x400E14: run_replaces (test-expandargv.c:121)
  ==29710==    by 0x400F63: writeout_test (test-expandargv.c:151)
  ==29710==    by 0x401037: run_tests (test-expandargv.c:188)
  ==29710==    by 0x40124C: main (test-expandargv.c:264)


From f60778ef0f07983b0ba72ed97fe52b687de28abb Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyering@redhat.com>
Date: Tue, 8 Mar 2011 13:54:13 +0100
Subject: [PATCH] avoid memory overrun in a test leading to potential double-free

* testsuite/test-expandargv.c (writeout_test): Fix off-by-one error:
i.e., do copy the trailing NUL byte.
---
 libiberty/ChangeLog                   |    6 ++++++
 libiberty/testsuite/test-expandargv.c |    2 +-
 2 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
index dc92638..802cf96 100644
--- a/libiberty/ChangeLog
+++ b/libiberty/ChangeLog
@@ -1,6 +1,12 @@
+2011-03-08  Jim Meyering  <meyering@redhat.com>
+
+	avoid memory overrun in a test leading to potential double-free
+	* testsuite/test-expandargv.c (writeout_test): Fix off-by-one error:
+	i.e., do copy the trailing NUL byte.
+
 2011-02-28  Kai Tietz  <kai.tietz@onevision.com>

 	* filename_cmp.c (filename_ncmp): New function.
 	* functions.texi: Regenerated.

 2011-02-03  Ralf Wildenhues  <Ralf.Wildenhues@gmx.de>
diff --git a/libiberty/testsuite/test-expandargv.c b/libiberty/testsuite/test-expandargv.c
index c16a032..57b96b3 100644
--- a/libiberty/testsuite/test-expandargv.c
+++ b/libiberty/testsuite/test-expandargv.c
@@ -201,13 +201,13 @@ writeout_test (int test, const char * test_data)
   /* Generate RW copy of data for replaces */
   len = strlen (test_data);
   parse = malloc (sizeof (char) * (len + 1));
   if (parse == NULL)
     fatal_error (__LINE__, "Failed to malloc parse.", errno);
       
-  memcpy (parse, test_data, sizeof (char) * len);
+  memcpy (parse, test_data, sizeof (char) * (len + 1));
   /* Run all possible replaces */
   run_replaces (parse);

   fwrite (parse, len, sizeof (char), fd);
   free (parse);
   fclose (fd);
-- 
1.7.4.1.299.ga459d

Re: [PATCH] avoid memory overrun in a test leading to potential double-free

[DJ Delorie]

> avoid memory overrun in a test leading to potential double-free
> * testsuite/test-expandargv.c (writeout_test): Fix off-by-one error:
> i.e., do copy the trailing NUL byte.

Ok.  Thanks!

Re: [PATCH] avoid memory overrun in a test leading to potential double-free

[Mike Stump]

On Mar 8, 2011, at 11:23 AM, DJ Delorie wrote:
>> avoid memory overrun in a test leading to potential double-free
>> * testsuite/test-expandargv.c (writeout_test): Fix off-by-one error:
>> i.e., do copy the trailing NUL byte.
> 
> Ok.  Thanks!

Applied, thanks.  In general, you have to ask someone to apply things for you, if you can't actually do the checkin, after a patch is approved.