diff mbox series

[14/20] Fix off-by-one OOB write in iconv/tst-iconv-mt

Message ID 4b41e5f384f0416235a83e563823f18595484914.1666877952.git.szabolcs.nagy@arm.com
State Superseded
Headers
Series patches from the morello port |

Checks

Context Check Description
dj/TryBot-apply_patch success Patch applied to master at the time it was sent

Commit Message

Szabolcs Nagy Oct. 27, 2022, 3:33 p.m. UTC 
  The iconv buffer sizes must not include the \0 string terminator.

When \0 cannot be part of a valid character encoding glibc iconv
would copy it to the output as expected, but then later the explicit
output termination with *outbufpos = '\0' is out of bounds.
---
 iconv/tst-iconv-mt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Florian Weimer Oct. 28, 2022, 5:39 a.m. UTC | #1 
* Szabolcs Nagy via Libc-alpha:

> The iconv buffer sizes must not include the \0 string terminator.
>
> When \0 cannot be part of a valid character encoding glibc iconv
> would copy it to the output as expected, but then later the explicit
> output termination with *outbufpos = '\0' is out of bounds.
> ---
>  iconv/tst-iconv-mt.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/iconv/tst-iconv-mt.c b/iconv/tst-iconv-mt.c
> index daaebd273b..0320885c06 100644
> --- a/iconv/tst-iconv-mt.c
> +++ b/iconv/tst-iconv-mt.c
> @@ -58,11 +58,11 @@ worker (void * arg)
>  
>    char ascii[] = CONV_INPUT;
>    char *inbufpos = ascii;
> -  size_t inbytesleft = sizeof (CONV_INPUT);
> +  size_t inbytesleft = sizeof (CONV_INPUT) - 1;
>  
>    char *utf8 = xcalloc (sizeof (CONV_INPUT), 1);
>    char *outbufpos = utf8;
> -  size_t outbytesleft = sizeof (CONV_INPUT);
> +  size_t outbytesleft = sizeof (CONV_INPUT) - 1;
>  
>    if (tidx < TCOUNT/2)
>      /* The first half of the worker thread pool synchronize together here,

I would prefer to remove the null terminator and replace strncmp with
TEST_COMPARE_BLOB.

Thanks,
Florian
diff mbox series

Patch

diff --git a/iconv/tst-iconv-mt.c b/iconv/tst-iconv-mt.c
index daaebd273b..0320885c06 100644
--- a/iconv/tst-iconv-mt.c
+++ b/iconv/tst-iconv-mt.c
@@ -58,11 +58,11 @@  worker (void * arg)
 
   char ascii[] = CONV_INPUT;
   char *inbufpos = ascii;
-  size_t inbytesleft = sizeof (CONV_INPUT);
+  size_t inbytesleft = sizeof (CONV_INPUT) - 1;
 
   char *utf8 = xcalloc (sizeof (CONV_INPUT), 1);
   char *outbufpos = utf8;
-  size_t outbytesleft = sizeof (CONV_INPUT);
+  size_t outbytesleft = sizeof (CONV_INPUT) - 1;
 
   if (tidx < TCOUNT/2)
     /* The first half of the worker thread pool synchronize together here,