Skip to contentSkip to conversation

column: avoid memory overrun and/or use of uninitialized buffer

PATCH Applied Jim Meyering 2 participants 2 messages Nov 16, 2011 Util-Linux package

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 column: avoid memory overrun and/or use of uninitialized buffer

* text-utils/column.c (maketbl): Use the right starting point and the right length when zeroing new memory after xrealloc.
---
Hi,

I ran coverity on the latest from git and it caught part of this (the erroneous offset-by-sizeof). I noticed that the "int" should be size_t or -- better -- *lens. With the latter, there is no risk that a type change will fail to propagate to this sizeof stmt.

 text-utils/column.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
text-utils/column.c +2 -2
index f8fd350..79d2842 100644
@@ -305,8 +305,8 @@ static void maketbl(wchar_t **list, int entries, wchar_t *separator)
 				cols = xrealloc(cols, maxcols * sizeof(wchar_t *));
 				lens = xrealloc(lens, maxcols * sizeof(ssize_t));
 				/* zero fill only new memory */
-				memset(lens + ((maxcols - DEFCOLS) * sizeof(ssize_t)), 0,
-				       DEFCOLS * sizeof(int));
+				memset(lens + (maxcols - DEFCOLS), 0,
+				       DEFCOLS * sizeof(*lens));
 			}
 			p = NULL;
 		}

--
1.7.8.rc2

maintainer Applied
#1 lore raw
Quoted 8 lines · Jim Meyering
 text-utils/column.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
text-utils/column.c +0 -0
index f8fd350..79d2842 100644

text-utils/column.c static void maketbl(wchar_t **list, int entries, wchar_t *separator) · line 309

Quoted 7 lines
text-utils/column.c +2 -2
@@ -305,8 +305,8 @@ static void maketbl(wchar_t **list, int entries, wchar_t *separator)
 				cols = xrealloc(cols, maxcols * sizeof(wchar_t *));
 				lens = xrealloc(lens, maxcols * sizeof(ssize_t));
 				/* zero fill only new memory */
-				memset(lens + ((maxcols - DEFCOLS) * sizeof(ssize_t)), 0,
-				       DEFCOLS * sizeof(int));
+				memset(lens + (maxcols - DEFCOLS), 0,
+				       DEFCOLS * sizeof(*lens));

Ah, this is my bug... (in the original code was cast to char *).

Applied, thanks.

Karel

Signature · 2 lines
 Karel Zak  <[email protected]>
 http://karelzak.blogspot.com