Re: [Bluez PATCH v1] textfile: Fix possible bad memory access in find_key

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Howard,

On Thu, Oct 31, 2024 at 12:04 AM Howard Chung <howardchung@xxxxxxxxxx> wrote:
>
> From: Yun-Hao Chung <howardchung@xxxxxxxxxx>
>
> If the searched key is a prefix of the first key in the textfile,
> the code will assume it's not the first line which is wrong.

We might want to include a backtrace if there is one.

> ---
> This is reproduced by fuzzer: https://issues.oss-fuzz.com/issues/42515619
>
>  src/textfile.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/src/textfile.c b/src/textfile.c
> index 313098f38..8188d2ebe 100644
> --- a/src/textfile.c
> +++ b/src/textfile.c
> @@ -127,10 +127,10 @@ static inline char *find_key(char *map, size_t size, const char *key, size_t len
>         while (ptrlen > len + 1) {
>                 int cmp = (icase) ? strncasecmp(ptr, key, len) : strncmp(ptr, key, len);
>                 if (cmp == 0) {
> -                       if (ptr == map && *(ptr + len) == ' ')
> -                               return ptr;
> -
> -                       if ((*(ptr - 1) == '\r' || *(ptr - 1) == '\n') &&
> +                       if (ptr == map) {
> +                               if (*(ptr + len) == ' ')
> +                                       return ptr;
> +                       } else if ((*(ptr - 1) == '\r' || *(ptr - 1) == '\n') &&
>                                                         *(ptr + len) == ' ')
>                                 return ptr;
>                 }
> --
> 2.47.0.163.g1226f6d8fa-goog
>


-- 
Luiz Augusto von Dentz





[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux