* [PATCH] Off-by-one fix for dl-sysdep.c
@ 2003-03-11 8:57 Jakub Jelinek
2003-03-11 12:55 ` Roland McGrath
0 siblings, 1 reply; 2+ messages in thread
From: Jakub Jelinek @ 2003-03-11 8:57 UTC (permalink / raw)
To: Ulrich Drepper, Roland McGrath; +Cc: Glibc hackers
Hi!
The code later does:
cp = __mempcpy ((char *) (result + *sz), temp[0].str, temp[0].len);
*cp = '/';
and so the final '/' is past the end of the malloced buffer.
2003-03-11 Jakub Jelinek <jakub@redhat.com>
* sysdeps/generic/dl-sysdep.c (_dl_important_hwcaps): If cnt == 1,
allocate space even for the trailing '/'. Reported by
John Reiser <jreiser@BitWagon.com>.
--- libc/sysdeps/generic/dl-sysdep.c.jj 2003-03-06 12:26:22.000000000 -0500
+++ libc/sysdeps/generic/dl-sysdep.c 2003-03-11 02:34:48.000000000 -0500
@@ -338,7 +338,7 @@ _dl_important_hwcaps (const char *platfo
/* Determine the total size of all strings together. */
if (cnt == 1)
- total = temp[0].len;
+ total = temp[0].len + 1;
else
{
total = (1UL << (cnt - 2)) * (temp[0].len + temp[cnt - 1].len + 2);
Jakub
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] Off-by-one fix for dl-sysdep.c
2003-03-11 8:57 [PATCH] Off-by-one fix for dl-sysdep.c Jakub Jelinek
@ 2003-03-11 12:55 ` Roland McGrath
0 siblings, 0 replies; 2+ messages in thread
From: Roland McGrath @ 2003-03-11 12:55 UTC (permalink / raw)
To: Jakub Jelinek; +Cc: Glibc hackers
Thanks, I've put in this fix.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2003-03-11 9:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-03-11 8:57 [PATCH] Off-by-one fix for dl-sysdep.c Jakub Jelinek
2003-03-11 12:55 ` Roland McGrath
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).