public inbox for glibc-cvs@sourceware.org
help / color / mirror / Atom feed
* [glibc] Fix off-by-one OOB write in iconv/tst-iconv-mt
@ 2023-10-04 7:33 Szabolcs Nagy
0 siblings, 0 replies; only message in thread
From: Szabolcs Nagy @ 2023-10-04 7:33 UTC (permalink / raw)
To: glibc-cvs
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0a520f28ffc8820d46074a71323db4c9652873be
commit 0a520f28ffc8820d46074a71323db4c9652873be
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date: Mon Sep 26 15:38:19 2022 +0100
Fix off-by-one OOB write in iconv/tst-iconv-mt
The iconv buffer sizes must not include the \0 string terminator.
And the output termination with *outbufpos = '\0' was OOB.
Consistently use non-null-terminated buffer sizes.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Diff:
---
iconv/tst-iconv-mt.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/iconv/tst-iconv-mt.c b/iconv/tst-iconv-mt.c
index e634eec1b7..8d7867b323 100644
--- a/iconv/tst-iconv-mt.c
+++ b/iconv/tst-iconv-mt.c
@@ -57,12 +57,13 @@ worker (void * arg)
iconv_t cd;
char ascii[] = CONV_INPUT;
+ size_t bytes = sizeof (CONV_INPUT) - 1;
char *inbufpos = ascii;
- size_t inbytesleft = sizeof (CONV_INPUT);
+ size_t inbytesleft = bytes;
- char *utf8 = xcalloc (sizeof (CONV_INPUT), 1);
+ char *utf8 = xcalloc (bytes, 1);
char *outbufpos = utf8;
- size_t outbytesleft = sizeof (CONV_INPUT);
+ size_t outbytesleft = bytes;
if (tidx < TCOUNT/2)
/* The first half of the worker thread pool synchronize together here,
@@ -91,8 +92,6 @@ worker (void * arg)
&outbytesleft)
!= (size_t) -1);
- *outbufpos = '\0';
-
xpthread_barrier_wait (&sync);
TEST_VERIFY_EXIT (iconv_close (cd) == 0);
@@ -104,11 +103,7 @@ worker (void * arg)
if (tidx < TCOUNT/2)
xpthread_barrier_wait (&sync);
- if (strncmp (utf8, CONV_INPUT, sizeof CONV_INPUT))
- {
- printf ("FAIL: thread %lx: invalid conversion output from iconv\n", tidx);
- pthread_exit ((void *) (long int) 1);
- }
+ TEST_COMPARE_BLOB (utf8, bytes, CONV_INPUT, bytes);
pthread_exit (NULL);
}
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2023-10-04 7:33 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-10-04 7:33 [glibc] Fix off-by-one OOB write in iconv/tst-iconv-mt Szabolcs Nagy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).