diff mbox series

Protect strcat from accessing an unaligend long pointer

Message ID 00739ce5fd071481f810784bbcc5f5d2fdf4e51e.camel@espressif.com
State New
Headers
Series Protect strcat from accessing an unaligend long pointer |

Commit Message

Alexey Lapshin Feb. 12, 2025, 3:14 a.m. UTC 
  - related to Bug libc/32679
---
 newlib/libc/string/strcat.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

-- 
2.43.0

Comments

Alexey Lapshin Feb. 12, 2025, 3:19 a.m. UTC | #1 
This is fix for strcat, the same as for strNcat:
https://sourceware.org/git/?p=newlib-cygwin.git;a=commit;h=a473f960e58bdc540eb8b6eb7f3efb52ff99cb33

Sorry for missing this bug.

Regards,
Alexey
Corinna Vinschen Feb. 12, 2025, 9:35 a.m. UTC | #2 
On Feb 12 03:14, Alexey Lapshin wrote:
> - related to Bug libc/32679
> ---
>  newlib/libc/string/strcat.c | 21 ++++++++++++---------
>  1 file changed, 12 insertions(+), 9 deletions(-)

Pushed.

Thanks,
Corinna
diff mbox series

Patch

diff --git a/newlib/libc/string/strcat.c b/newlib/libc/string/strcat.c
index 47c53a5d2..e213e2d91 100644
--- a/newlib/libc/string/strcat.c
+++ b/newlib/libc/string/strcat.c
@@ -54,15 +54,18 @@  strcat (char *__restrict s1,
   while (UNALIGNED_X(s1) && *s1)
     s1++;
 
-  /* Skip over the aligned data in s1 as quickly as possible.  */
-  unsigned long *aligned_s1 = (unsigned long *)s1;
-  while (!DETECT_NULL(*aligned_s1))
-    aligned_s1++;
-  s1 = (char *)aligned_s1;
-
-  /* Find string terminator.  */
-  while (*s1)
-    s1++;
+  if (*s1)
+    {
+      /* Skip over the aligned data in s1 as quickly as possible.  */
+      unsigned long *aligned_s1 = (unsigned long *)s1;
+      while (!DETECT_NULL(*aligned_s1))
+        aligned_s1++;
+      s1 = (char *)aligned_s1;
+
+      /* Find string terminator.  */
+      while (*s1)
+        s1++;
+    }
 
   /* s1 now points to the its trailing null character, we can
      just use strcpy to do the work for us now.