9front - general discussion about 9front
 help / color / mirror / Atom feed
From: Steffen Nurpmeso <steffen@sdaoden.eu>
To: 9front@9front.org
Subject: Re: [9front] werc memory over flow
Date: Sat, 12 Mar 2022 15:38:03 +0100	[thread overview]
Message-ID: <20220312143803.nKiSo%steffen@sdaoden.eu> (raw)
In-Reply-To: <C5AF8865-7335-46CE-A101-EE8F1DF9501C@quintile.net>

Steve Simon wrote in
 <C5AF8865-7335-46CE-A101-EE8F1DF9501C@quintile.net>:
 |forward the fix to mr kernighan - perhaps you will get a prize? ;-)

Mr. BW. K's awk is now maintained by someone else at

  https://github.com/onetrueawk/awk.git

(after Arnold Robbins had a long stint).

Cool that 9front git shows the updates again btw!!!
Though my last one is facb0e757ac63f763bd942a2714f979538b99eb0
now, from 2021-12-22?

 |-Steve
 |
 |> On 12 Mar 2022, at 11:58 am, cinap_lenrek@felloff.net wrote:
 |> 
 |> actually, i think i found it (by staring at the code).
 |> 
 |> the code at the done label was unconditionally inserting
 |> NUL terminator, without the final adjbuf() ensuring
 |> theres space for it.
 |> 
 |> the patch gets rid of the label, so we wont skip the
 |> final adjbuf().
 |> 
 |> diff d52f25ecdcf1dc8ee8d278c8da44159d82d8dd8f uncommitted
 |> --- a/sys/src/cmd/awk/run.c
 |> +++ b/sys/src/cmd/awk/run.c
 |> @@ -1934,7 +1934,7 @@
 |>}
 |>}
 |>                if (*c == 0)    /* at end */
 |> -                    goto done;
 |> +                    break;

At least that is still there.

 |>                adjbuf(&buf, &bufsz, 2+pb-buf, recsize, &pb, "gsub");
 |>                *pb++ = *c++;
 |>                if (pb > buf + bufsz)    /* BUG: not sure of this test */
 |> @@ -1962,8 +1962,12 @@
 |>                        *pb++ = *sptr++;
 |>}
 |>                c = patbeg + patlen;
 |> -                if ((c[-1] == 0) || (*c == 0))
 |> -                    goto done;
 |> +                if (c[-1] == 0){
 |> +                    c--;
 |> +                    break;
 |> +                }
 |> +                if (*c == 0)
 |> +                    break;

That is different now:

 |>                if (pb > buf + bufsz)
 |>                    FATAL("gsub result1 %.30s too big; can't happen", \
 |>                    buf);
 |>                mflag = 1;


                      } else
                              *pb++ = *sptr++;
              }
              t = patbeg + patlen;
              if (patlen == 0 || *t == '\0' || *(t-1) == '\0')
                      goto done;
              if (pb > buf + bufsz)
                      FATAL("gsub result1 %.30s too big; can't happen", buf);
              mflag = 1;

Here too:

 |> @@ -1973,7 +1977,7 @@
 |>        adjbuf(&buf, &bufsz, 1+strlen(sptr)+pb-buf, 0, &pb, "gsub");
 |>        while ((*pb++ = *sptr++) != 0)
 |4>            ;
 |> -    done:    if (pb > buf + bufsz)
 |> +        if (pb > buf + bufsz)
 |>            FATAL("gsub result2 %.30s too big; can't happen", buf);

      done:   if (pb < buf + bufsz)
                      *pb = '\0';
              else if (*(pb-1) != '\0')
                      FATAL("gsub result2 %.30s truncated; can't happen", buf);


 |>        *pb = '\0';
 |>        setsval(x, buf);    /* BUG: should be able to avoid copy + free */
 |> 
 |> --
 |> cinap
 --End of <C5AF8865-7335-46CE-A101-EE8F1DF9501C@quintile.net>

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)

  reply	other threads:[~2022-03-13  4:08 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-11  6:24 william
2022-03-11  6:33 ` ori
2022-03-11 15:18 ` ori
2022-03-12 11:23   ` cinap_lenrek
2022-03-12 11:54     ` cinap_lenrek
2022-03-12 12:34       ` cinap_lenrek
2022-03-13  7:27         ` william
2022-03-13 21:16           ` cinap_lenrek
2022-03-12 13:27       ` Steve Simon
2022-03-12 14:38         ` Steffen Nurpmeso [this message]
2022-03-11 16:49 ` Nick Owens
2022-03-11 20:13 ` cinap_lenrek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220312143803.nKiSo%steffen@sdaoden.eu \
    --to=steffen@sdaoden.eu \
    --cc=9front@9front.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).