jaiden
/
apk-tools
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

apk: fix all_options array size off-by-one 

merge_options() will write one more entry to the options table
which is the end-of-table indicator. Allocate memory for it too.
valgrind did not pick it up due to being in stack; changing alloca
to malloc would make valgrind notice the issue too.

Reported-by: Mobile Stream <info@mobile-stream.com>
cute-signatures
Timo Teräs 2018-10-05 09:45:02 +03:00
parent 0e3be0fd4a
commit 40ffdfe623
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/apk.c
View File

@ -542,7 +542,7 @@ int main(int argc, char **argv)
applet = deduce_applet(argc, argv);
if (applet && applet->optgroups[0]) optgroups = applet->optgroups;
for (i = 0, num_options = 0; optgroups[i]; i++)
for (i = 0, num_options = 1; optgroups[i]; i++)
num_options += optgroups[i]->num_options;
all_options = alloca(sizeof(struct option) * num_options);
for (i = r = 0; optgroups[i]; r += optgroups[i]->num_options, i++)