public inbox for libc-alpha@sourceware.org
 help / color / mirror / Atom feed
From: Florian Weimer <fweimer@redhat.com>
To: Szabolcs Nagy via Libc-alpha <libc-alpha@sourceware.org>
Cc: Szabolcs Nagy <szabolcs.nagy@arm.com>
Subject: Re: [PATCH 17/20] Fix missing NUL terminator in stdio-common/scanf13 test
Date: Fri, 28 Oct 2022 07:44:56 +0200	[thread overview]
Message-ID: <87v8o4h57r.fsf@oldenburg.str.redhat.com> (raw)
In-Reply-To: <40002e888f5b950c07b0bff781f151771fcd0f10.1666877952.git.szabolcs.nagy@arm.com> (Szabolcs Nagy via Libc-alpha's message of "Thu, 27 Oct 2022 16:33:42 +0100")

* Szabolcs Nagy via Libc-alpha:

> sscanf is only defined on nul terminated string input, but '\0' was
> missing in this test which caused _IO_str_init_static_internal to
> read OOB on the stack when computing the bounds of the string.
> ---
>  stdio-common/scanf13.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/stdio-common/scanf13.c b/stdio-common/scanf13.c
> index 720224aa05..60aa62a26f 100644
> --- a/stdio-common/scanf13.c
> +++ b/stdio-common/scanf13.c
> @@ -67,6 +67,7 @@ main (void)
>    buf[2049] = 0x84;
>    buf[2058] = '\t';
>    buf[2059] = 'a';
> +  buf[sizeof (buf) - 1] = '\0';
>    if (sscanf (buf, "%ms%mc", &sp1, &sp2) != 2)
>      FAIL ();
>    else

We want this test to be correct (see bug 17577), but for now this is the
right change.

Reviewed-by: Florian Weimer <fweimer@redhat.com>

Thanks,
Florian


  reply	other threads:[~2022-10-28  5:45 UTC|newest]

Thread overview: 52+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-10-27 15:32 [PATCH 00/20] patches from the morello port Szabolcs Nagy
2022-10-27 15:32 ` [PATCH 01/20] Fix OOB read in stdlib thousand grouping parsing [BZ #29727] Szabolcs Nagy
2022-10-27 15:38   ` Andreas Schwab
2022-10-27 15:32 ` [PATCH 02/20] scripts: Use bool in tunables initializer Szabolcs Nagy
2022-10-27 16:29   ` Florian Weimer
2022-10-27 15:32 ` [PATCH 03/20] aarch64: Don't build wordcopy Szabolcs Nagy
2022-10-27 16:59   ` Adhemerval Zanella Netto
2022-10-27 15:32 ` [PATCH 04/20] aarch64: Fix the extension header write in getcontext and swapcontext Szabolcs Nagy
2022-10-28 14:03   ` Adhemerval Zanella Netto
2022-10-27 15:32 ` [PATCH 05/20] Fix invalid pointer dereference in wcscpy_chk Szabolcs Nagy
2022-10-28  5:34   ` Florian Weimer
2022-10-27 15:32 ` [PATCH 06/20] Fix invalid pointer dereference in wcpcpy_chk Szabolcs Nagy
2022-10-28  5:45   ` Florian Weimer
2022-10-27 15:32 ` [PATCH 07/20] Use uintptr_t in fts for pointer alignment Szabolcs Nagy
2022-10-31 16:08   ` Adhemerval Zanella Netto
2022-10-27 15:32 ` [PATCH 08/20] malloc: Use uintptr_t " Szabolcs Nagy
2022-10-31 16:09   ` Adhemerval Zanella Netto
2022-10-27 15:32 ` [PATCH 09/20] malloc: Use uintptr_t in alloc_buffer Szabolcs Nagy
2022-10-27 16:15   ` Florian Weimer
2022-10-27 15:33 ` [PATCH 10/20] malloc: Fix alignment logic in obstack Szabolcs Nagy
2022-10-31 16:14   ` Adhemerval Zanella Netto
2022-11-01  9:43     ` Szabolcs Nagy
2022-11-01 13:07       ` Adhemerval Zanella Netto
2022-10-27 15:33 ` [PATCH 11/20] elf: Fix alloca size in _dl_debug_vdprintf Szabolcs Nagy
2022-10-28  5:31   ` Florian Weimer
2022-10-28 13:56   ` Adhemerval Zanella Netto
2022-10-28 14:43     ` Szabolcs Nagy
2022-10-28 14:48       ` Adhemerval Zanella Netto
2022-10-27 15:33 ` [PATCH 12/20] Fix the symbolic link of multilib dirs Szabolcs Nagy
2022-10-27 15:33 ` [PATCH 13/20] Use uintptr_t in string/tester for pointer alignment Szabolcs Nagy
2022-10-28 14:11   ` Adhemerval Zanella Netto
2022-10-27 15:33 ` [PATCH 14/20] Fix off-by-one OOB write in iconv/tst-iconv-mt Szabolcs Nagy
2022-10-28  5:39   ` Florian Weimer
2022-10-27 15:33 ` [PATCH 15/20] Fix off-by-one OOB read in elf/tst-tls20 Szabolcs Nagy
2022-10-28  5:36   ` Florian Weimer
2022-10-27 15:33 ` [PATCH 16/20] Fix malloc/tst-scratch_buffer OOB access Szabolcs Nagy
2022-10-28  5:41   ` Florian Weimer
2022-10-28 11:24     ` Szabolcs Nagy
2022-10-28 11:30       ` Florian Weimer
2022-10-28 12:23         ` Szabolcs Nagy
2022-10-28 12:27           ` Florian Weimer
2022-10-27 15:33 ` [PATCH 17/20] Fix missing NUL terminator in stdio-common/scanf13 test Szabolcs Nagy
2022-10-28  5:44   ` Florian Weimer [this message]
2022-10-27 15:33 ` [PATCH 18/20] Fix elf/tst-dlmopen-twice to support enough link namespaces Szabolcs Nagy
2022-10-27 16:24   ` Florian Weimer
2022-10-27 16:45     ` Szabolcs Nagy
2022-10-27 16:51       ` Florian Weimer
2022-10-27 16:47     ` Adhemerval Zanella Netto
2022-10-27 15:33 ` [PATCH 19/20] Fix resource/bug-ulimit1 test Szabolcs Nagy
2022-10-27 16:48   ` Adhemerval Zanella Netto
2022-10-27 15:34 ` [PATCH 20/20] Fix stdlib/test-dlclose-exit-race to not hang Szabolcs Nagy
2022-10-27 16:22   ` Florian Weimer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87v8o4h57r.fsf@oldenburg.str.redhat.com \
    --to=fweimer@redhat.com \
    --cc=libc-alpha@sourceware.org \
    --cc=szabolcs.nagy@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).