From: Steffen Nurpmeso <steffen@sdaoden.eu>
To: 9front@9front.org
Subject: Re: [9front] werc memory over flow
Date: Sat, 12 Mar 2022 15:38:03 +0100 [thread overview]
Message-ID: <20220312143803.nKiSo%steffen@sdaoden.eu> (raw)
In-Reply-To: <C5AF8865-7335-46CE-A101-EE8F1DF9501C@quintile.net>
Steve Simon wrote in
<C5AF8865-7335-46CE-A101-EE8F1DF9501C@quintile.net>:
|forward the fix to mr kernighan - perhaps you will get a prize? ;-)
Mr. BW. K's awk is now maintained by someone else at
https://github.com/onetrueawk/awk.git
(after Arnold Robbins had a long stint).
Cool that 9front git shows the updates again btw!!!
Though my last one is facb0e757ac63f763bd942a2714f979538b99eb0
now, from 2021-12-22?
|-Steve
|
|> On 12 Mar 2022, at 11:58 am, cinap_lenrek@felloff.net wrote:
|>
|> actually, i think i found it (by staring at the code).
|>
|> the code at the done label was unconditionally inserting
|> NUL terminator, without the final adjbuf() ensuring
|> theres space for it.
|>
|> the patch gets rid of the label, so we wont skip the
|> final adjbuf().
|>
|> diff d52f25ecdcf1dc8ee8d278c8da44159d82d8dd8f uncommitted
|> --- a/sys/src/cmd/awk/run.c
|> +++ b/sys/src/cmd/awk/run.c
|> @@ -1934,7 +1934,7 @@
|>}
|>}
|> if (*c == 0) /* at end */
|> - goto done;
|> + break;
At least that is still there.
|> adjbuf(&buf, &bufsz, 2+pb-buf, recsize, &pb, "gsub");
|> *pb++ = *c++;
|> if (pb > buf + bufsz) /* BUG: not sure of this test */
|> @@ -1962,8 +1962,12 @@
|> *pb++ = *sptr++;
|>}
|> c = patbeg + patlen;
|> - if ((c[-1] == 0) || (*c == 0))
|> - goto done;
|> + if (c[-1] == 0){
|> + c--;
|> + break;
|> + }
|> + if (*c == 0)
|> + break;
That is different now:
|> if (pb > buf + bufsz)
|> FATAL("gsub result1 %.30s too big; can't happen", \
|> buf);
|> mflag = 1;
} else
*pb++ = *sptr++;
}
t = patbeg + patlen;
if (patlen == 0 || *t == '\0' || *(t-1) == '\0')
goto done;
if (pb > buf + bufsz)
FATAL("gsub result1 %.30s too big; can't happen", buf);
mflag = 1;
Here too:
|> @@ -1973,7 +1977,7 @@
|> adjbuf(&buf, &bufsz, 1+strlen(sptr)+pb-buf, 0, &pb, "gsub");
|> while ((*pb++ = *sptr++) != 0)
|4> ;
|> - done: if (pb > buf + bufsz)
|> + if (pb > buf + bufsz)
|> FATAL("gsub result2 %.30s too big; can't happen", buf);
done: if (pb < buf + bufsz)
*pb = '\0';
else if (*(pb-1) != '\0')
FATAL("gsub result2 %.30s truncated; can't happen", buf);
|> *pb = '\0';
|> setsval(x, buf); /* BUG: should be able to avoid copy + free */
|>
|> --
|> cinap
--End of <C5AF8865-7335-46CE-A101-EE8F1DF9501C@quintile.net>
--steffen
|
|Der Kragenbaer, The moon bear,
|der holt sich munter he cheerfully and one by one
|einen nach dem anderen runter wa.ks himself off
|(By Robert Gernhardt)
next prev parent reply other threads:[~2022-03-13 4:08 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-11 6:24 william
2022-03-11 6:33 ` ori
2022-03-11 15:18 ` ori
2022-03-12 11:23 ` cinap_lenrek
2022-03-12 11:54 ` cinap_lenrek
2022-03-12 12:34 ` cinap_lenrek
2022-03-13 7:27 ` william
2022-03-13 21:16 ` cinap_lenrek
2022-03-12 13:27 ` Steve Simon
2022-03-12 14:38 ` Steffen Nurpmeso [this message]
2022-03-11 16:49 ` Nick Owens
2022-03-11 20:13 ` cinap_lenrek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220312143803.nKiSo%steffen@sdaoden.eu \
--to=steffen@sdaoden.eu \
--cc=9front@9front.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).