forked from ariadne/pkgconf
bd4ed1ca02
pkgconf_fgetline is called with a user-defined buffer, its size, and a FILE stream to read input from. If the buffer is almost completely filled and the file stream contains an escaped character, then it is possible to trigger an off-by-one buffer overflow with a '\0' character. Easiest example to trigger this: char buf[2]; pkgconf_fgetline(buf, sizeof(buf), stdin); Enter "\\" (two backslashes) and press enter. If the library and the program are compiled with address sanitizer, you will see the program crashing. Otherwise it depends on your architecture what happens. Since nobody should be using a buffer of only size 1 or 2, keep enough space for a possibly escaped character in while loop by subtracting one more byte for this situation, not just for '\0'. |
||
|---|---|---|
| .. | ||
| argvsplit.c | ||
| audit.c | ||
| bsdstubs.c | ||
| bsdstubs.h | ||
| cache.c | ||
| client.c | ||
| config.h.meson | ||
| dependency.c | ||
| fileio.c | ||
| fragment.c | ||
| iter.h | ||
| libpkgconf-api.h | ||
| libpkgconf.h | ||
| meson.build | ||
| parser.c | ||
| path.c | ||
| personality.c | ||
| pkg.c | ||
| queue.c | ||
| stdinc.h | ||
| tuple.c | ||
| win-dirent.h | ||