From: qwx <qwx@sciops.net>
To: 9front@9front.org
Subject: vncv: realloc memory corruption
Date: Mon, 26 Aug 2019 01:05:26 +0200 [thread overview]
Message-ID: <C93B0E3C42C2FE0EA9B1860C885109C8@wopr.sciops.net> (raw)
Hello,
In /sys/src/cmd/vnc/wsys.c:/^getsnarf, /dev/snarf's contents
are being read into a buffer, which is grown in 8192 byte increments
using realloc.
The code assumes that realloc will always return the same pointer,
and the p variable is never updated. On subsequent reads, memory
may be corrupted.
I've hit this multiple times when snarfing a large amount of text
while a vncv is running.
Example:
% vncv host
# in another window:
% cat /lib/dicewords >/dev/snarf
The following patch fixes this.
Any objections to merging this?
Thanks,
qwx
diff -r bb28fe19fe44 sys/src/cmd/vnc/wsys.c
--- a/sys/src/cmd/vnc/wsys.c Mon Aug 19 16:42:20 2019 +0200
+++ b/sys/src/cmd/vnc/wsys.c Mon Aug 26 00:49:19 2019 +0200
@@ -281,6 +281,7 @@
*sz += c;
if (n == 0){
snarf = realloc(snarf, *sz + 8192);
+ p = snarf + *sz;
n = 8192;
}
}
reply other threads:[~2019-08-25 23:05 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=C93B0E3C42C2FE0EA9B1860C885109C8@wopr.sciops.net \
--to=qwx@sciops.net \
--cc=9front@9front.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).