column: avoid memory overrun and/or use of uninitialized buffer
PATCH 1/1 column: avoid memory overrun and/or use of uninitialized buffer
* text-utils/column.c (maketbl): Use the right starting point and the right length when zeroing new memory after xrealloc.
---
Hi,
I ran coverity on the latest from git and it caught part of this (the erroneous offset-by-sizeof). I noticed that the "int" should be size_t or -- better -- *lens. With the latter, there is no risk that a type change will fail to propagate to this sizeof stmt.
text-utils/column.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
text-utils/column.c +2 -2
@@ -305,8 +305,8 @@ static void maketbl(wchar_t **list, int entries, wchar_t *separator) cols =xrealloc (cols, maxcols *sizeof (wchar_t *)); lens =xrealloc (lens, maxcols *sizeof (ssize_t ));/* zero fill only new memory */ -memset (lens + ((maxcols -DEFCOLS ) *sizeof (ssize_t )),0 , -DEFCOLS *sizeof (int )); +memset (lens + (maxcols -DEFCOLS ),0 , +DEFCOLS *sizeof (*lens)); } p =NULL ; }
--
1.7.8.rc2
Quoted 8 lines · Jim Meyering
text-utils/column.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)text-utils/column.c +0
-0
text-utils/column.c static void maketbl(wchar_t **list, int entries, wchar_t *separator) · line 309
Quoted 7 lines
text-utils/column.c +2
-2@@ -305,8 +305,8 @@ static void maketbl(wchar_t **list, int entries, wchar_t *separator) cols =xrealloc (cols, maxcols *sizeof (wchar_t *)); lens =xrealloc (lens, maxcols *sizeof (ssize_t ));/* zero fill only new memory */ -memset (lens + ((maxcols -DEFCOLS ) *sizeof (ssize_t )),0 , -DEFCOLS *sizeof (int )); +memset (lens + (maxcols -DEFCOLS ),0 , +DEFCOLS *sizeof (*lens));
Ah, this is my bug... (in the original code was cast to char *).
Applied, thanks.
Karel
Signature · 2 lines
Karel Zak <[email protected]> http://karelzak.blogspot.com