Possible out of bounds memory write in initialization of xdigits in src/stdio/vfprintf.c

[Mark Winterrowd <markwinterrowd4@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 688 bytes --]

Hi all,

On line 148 of src/stdio/vfprintf.c in the source tree head, you can
observe the following global initialization:

static const char xdigits[16] = {
"0123456789ABCDEF"
};

Note that while this xdigits array has a length of 16, the string it is
being initialized to has a length of 17, due to the implicit null
terminator. Thus, an additional '\0' will be written just past the end of
this global. I believe this could cause unpredictable effects depending
upon how the compiler and linker handle this situation.

The fix is simple, just write out a list of comma separated characters to
eliminate the null terminator or make xdigits have a length of 17.

Thanks,
Mark Winterrowd

[-- Attachment #2: Type: text/html, Size: 830 bytes --]