Re: [9front] werc memory over flow

[cinap_lenrek@felloff.net]

actually, i think i found it (by staring at the code).

the code at the done label was unconditionally inserting
NUL terminator, without the final adjbuf() ensuring
theres space for it.

the patch gets rid of the label, so we wont skip the
final adjbuf().

diff d52f25ecdcf1dc8ee8d278c8da44159d82d8dd8f uncommitted
--- a/sys/src/cmd/awk/run.c
+++ b/sys/src/cmd/awk/run.c
@@ -1934,7 +1934,7 @@
 					}
 				}
 				if (*c == 0)	/* at end */
-					goto done;
+					break;
 				adjbuf(&buf, &bufsz, 2+pb-buf, recsize, &pb, "gsub");
 				*pb++ = *c++;
 				if (pb > buf + bufsz)	/* BUG: not sure of this test */
@@ -1962,8 +1962,12 @@
 						*pb++ = *sptr++;
 				}
 				c = patbeg + patlen;
-				if ((c[-1] == 0) || (*c == 0))
-					goto done;
+				if (c[-1] == 0){
+					c--;
+					break;
+				}
+				if (*c == 0)
+					break;
 				if (pb > buf + bufsz)
 					FATAL("gsub result1 %.30s too big; can't happen", buf);
 				mflag = 1;
@@ -1973,7 +1977,7 @@
 		adjbuf(&buf, &bufsz, 1+strlen(sptr)+pb-buf, 0, &pb, "gsub");
 		while ((*pb++ = *sptr++) != 0)
 			;
-	done:	if (pb > buf + bufsz)
+		if (pb > buf + bufsz)
 			FATAL("gsub result2 %.30s too big; can't happen", buf);
 		*pb = '\0';
 		setsval(x, buf);	/* BUG: should be able to avoid copy + free */

--
cinap