diff mbox series

[06/20] Fix invalid pointer dereference in wcpcpy_chk

Message ID 71f695945d1079b8f49f60bd0cfc59e0f3c2adfc.1666877952.git.szabolcs.nagy@arm.com
State Committed
Commit 3fa20d59d9607e4494dfbc99bacee1935ec5ded9
Headers
Series patches from the morello port |

Checks

Context Check Description
dj/TryBot-apply_patch success Patch applied to master at the time it was sent

Commit Message

Szabolcs Nagy Oct. 27, 2022, 3:32 p.m. UTC 
  The src pointer is const and points to a different object, so accessing
dest via src is invalid.
---
 debug/wcpcpy_chk.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Florian Weimer Oct. 28, 2022, 5:45 a.m. UTC | #1 
* Szabolcs Nagy via Libc-alpha:

> The src pointer is const and points to a different object, so accessing
> dest via src is invalid.
> ---
>  debug/wcpcpy_chk.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/debug/wcpcpy_chk.c b/debug/wcpcpy_chk.c
> index bc2be43c3e..d44fb479d0 100644
> --- a/debug/wcpcpy_chk.c
> +++ b/debug/wcpcpy_chk.c
> @@ -28,13 +28,12 @@ __wcpcpy_chk (wchar_t *dest, const wchar_t *src, size_t destlen)
>  {
>    wchar_t *wcp = (wchar_t *) dest - 1;
>    wint_t c;
> -  const ptrdiff_t off = src - dest + 1;
>  
>    do
>      {
>        if (__glibc_unlikely (destlen-- == 0))
>  	__chk_fail ();
> -      c = wcp[off];
> +      c = *src++;
>        *++wcp = c;
>      }
>    while (c != L'\0');

Looks reasonable.

Reviewed-by: Florian Weimer <fweimer@redhat.com>

Thanks,
Florian
diff mbox series

Patch

diff --git a/debug/wcpcpy_chk.c b/debug/wcpcpy_chk.c
index bc2be43c3e..d44fb479d0 100644
--- a/debug/wcpcpy_chk.c
+++ b/debug/wcpcpy_chk.c
@@ -28,13 +28,12 @@  __wcpcpy_chk (wchar_t *dest, const wchar_t *src, size_t destlen)
 {
   wchar_t *wcp = (wchar_t *) dest - 1;
   wint_t c;
-  const ptrdiff_t off = src - dest + 1;
 
   do
     {
       if (__glibc_unlikely (destlen-- == 0))
 	__chk_fail ();
-      c = wcp[off];
+      c = *src++;
       *++wcp = c;
     }
   while (c != L'\0');