sblim-sfcb/sblim-sfcb-1.3.16-invalid-read.patch

77 lines
3.3 KiB
Diff
Raw Normal View History

Function copyStringBuf() uses sizeof(*fb->indexPtr) as size of elements
in fb->indexPtr, while addClStringN() usess 'sizeof(long)' for the same
elements. Both functions copy indexPtr, but each with different size.
Therefore, if addClStringN() is called after copyStringBuf(), it may copy more
bytes than copyStringBuf() created -> SIGSEGV (or 'Invalid read of size XYZ'
in Valgrind logs).
'sizeof(*buf->indexPtr)' should be consistently used in ClStrBuf.indexPtr
and ClArrayBuf.indexPtr.
diff -up sblim-sfcb-1.3.16/objectImpl.c.invalid-read sblim-sfcb-1.3.16/objectImpl.c
--- sblim-sfcb-1.3.16/objectImpl.c.invalid-read 2013-04-19 14:03:04.920602183 +0200
+++ sblim-sfcb-1.3.16/objectImpl.c 2013-04-19 14:04:10.229391267 +0200
@@ -208,7 +208,7 @@ addClStringN(ClObjectHdr * hdr, const ch
buf->bMax = nmax;
buf->bUsed = buf->iUsed = 0;
buf->iMax = 16;
- setStrIndexPtr(buf, malloc(sizeof(long) * 16));
+ setStrIndexPtr(buf, malloc(sizeof(*buf->indexPtr) * 16));
hdr->flags |= HDR_Rebuild;
}
@@ -222,17 +222,17 @@ addClStringN(ClObjectHdr * hdr, const ch
if (!isMallocedStrIndex(buf)) {
void *idx = buf->indexPtr;
buf->iMax = nmax * 2;
- setStrIndexPtr(buf, malloc(buf->iMax * sizeof(long)));
- memcpy(buf->indexPtr, idx, nmax * sizeof(long));
+ setStrIndexPtr(buf, malloc(buf->iMax * sizeof(*buf->indexPtr)));
+ memcpy(buf->indexPtr, idx, nmax * sizeof(*buf->indexPtr));
}
else {
buf->iMax = nmax * 2;
- setStrIndexPtr(buf, realloc(buf->indexPtr, buf->iMax * sizeof(long)));
+ setStrIndexPtr(buf, realloc(buf->indexPtr, buf->iMax * sizeof(*buf->indexPtr)));
}
}
else {
buf->iMax = 16;
- setStrIndexPtr(buf, malloc(buf->iMax * sizeof(long)));
+ setStrIndexPtr(buf, malloc(buf->iMax * sizeof(*buf->indexPtr)));
}
hdr->flags |= HDR_Rebuild;
}
@@ -289,7 +289,7 @@ static long addClArray(ClObjectHdr * hdr
buf->bMax = nmax;
buf->bUsed = buf->iUsed = 0;
buf->iMax = 16;
- setArrayIndexPtr(buf, malloc(sizeof(long) * 16));
+ setArrayIndexPtr(buf, malloc(sizeof(*buf->indexPtr) * 16));
hdr->flags |= HDR_Rebuild;
}
@@ -303,17 +303,17 @@ static long addClArray(ClObjectHdr * hdr
if (!isMallocedArrayIndex(buf)) {
void *idx = buf->indexPtr;
buf->iMax = nmax * 2;
- setArrayIndexPtr(buf, malloc(buf->iMax * sizeof(long)));
- memcpy(buf->indexPtr, idx, nmax * sizeof(long));
+ setArrayIndexPtr(buf, malloc(buf->iMax * sizeof(*buf->indexPtr)));
+ memcpy(buf->indexPtr, idx, nmax * sizeof(*buf->indexPtr));
}
else {
buf->iMax = nmax * 2;
- setArrayIndexPtr(buf, realloc(buf->indexPtr, buf->iMax * sizeof(long)));
+ setArrayIndexPtr(buf, realloc(buf->indexPtr, buf->iMax * sizeof(*buf->indexPtr)));
}
}
else {
buf->iMax = 16;
- setArrayIndexPtr(buf, malloc(buf->iMax * sizeof(long)));
+ setArrayIndexPtr(buf, malloc(buf->iMax * sizeof(*buf->indexPtr)));
}
hdr->flags |= HDR_Rebuild;
}