Re: [9front] werc memory over flow

[Steve Simon <steve@quintile.net>]

forward the fix to mr kernighan - perhaps you will get a prize? ;-)

-Steve

> On 12 Mar 2022, at 11:58 am, cinap_lenrek@felloff.net wrote:
> 
> actually, i think i found it (by staring at the code).
> 
> the code at the done label was unconditionally inserting
> NUL terminator, without the final adjbuf() ensuring
> theres space for it.
> 
> the patch gets rid of the label, so we wont skip the
> final adjbuf().
> 
> diff d52f25ecdcf1dc8ee8d278c8da44159d82d8dd8f uncommitted
> --- a/sys/src/cmd/awk/run.c
> +++ b/sys/src/cmd/awk/run.c
> @@ -1934,7 +1934,7 @@
>                    }
>                }
>                if (*c == 0)    /* at end */
> -                    goto done;
> +                    break;
>                adjbuf(&buf, &bufsz, 2+pb-buf, recsize, &pb, "gsub");
>                *pb++ = *c++;
>                if (pb > buf + bufsz)    /* BUG: not sure of this test */
> @@ -1962,8 +1962,12 @@
>                        *pb++ = *sptr++;
>                }
>                c = patbeg + patlen;
> -                if ((c[-1] == 0) || (*c == 0))
> -                    goto done;
> +                if (c[-1] == 0){
> +                    c--;
> +                    break;
> +                }
> +                if (*c == 0)
> +                    break;
>                if (pb > buf + bufsz)
>                    FATAL("gsub result1 %.30s too big; can't happen", buf);
>                mflag = 1;
> @@ -1973,7 +1977,7 @@
>        adjbuf(&buf, &bufsz, 1+strlen(sptr)+pb-buf, 0, &pb, "gsub");
>        while ((*pb++ = *sptr++) != 0)
>            ;
> -    done:    if (pb > buf + bufsz)
> +        if (pb > buf + bufsz)
>            FATAL("gsub result2 %.30s too big; can't happen", buf);
>        *pb = '\0';
>        setsval(x, buf);    /* BUG: should be able to avoid copy + free */
> 
> --
> cinap