From 377709664480a30fa5acdd11c7ca8c16669678ce Mon Sep 17 00:00:00 2001 From: Tavian Barnes Date: Wed, 6 Sep 2023 14:59:59 -0400 Subject: bfstd: Fix an OOB string index in xmbrtowc() This bug could be reproduced with something like $ bfs -samefile $'\xFA\xFA' bfs: error: bfs: dstrnescat@src/dstring.c:252: wordesc() result truncated or worse, with -DNDEBUG, $ bfs -samefile $'.....................\xFA\xFA' bfs: error: bfs -samefile $'.....................\xFA\xFA\x00\x55\x53\x45\x52\x3D\x74\x61\x76\x69\x61\x6E\x61\x74\x6F\x72 bfs: error: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bfs: error: No such file or directory. which prints the memory after the end of the string (in this case, the environment variable USER=tavianator). The bug was caused by the line `*i += len`, which was intended to be `*i = len`. But actually, the right behaviour seems to be `*i += 1`. Fixes: 19c96abe0a1ee56cf206fd5e87defb1fd3e0daa5 --- src/bfstd.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) (limited to 'src/bfstd.c') diff --git a/src/bfstd.c b/src/bfstd.c index e546a47..2d9f60a 100644 --- a/src/bfstd.c +++ b/src/bfstd.c @@ -546,15 +546,11 @@ int xstrtofflags(const char **str, unsigned long long *set, unsigned long long * static int xmbrtowc(wchar_t *wc, size_t *i, const char *str, size_t len, mbstate_t *mb) { size_t mblen = mbrtowc(wc, str + *i, len - *i, mb); switch (mblen) { - case -1: - // Invalid byte sequence + case -1: // Invalid byte sequence + case -2: // Incomplete byte sequence *i += 1; memset(mb, 0, sizeof(*mb)); return -1; - case -2: - // Incomplete byte sequence - *i += len; - return -1; default: *i += mblen; return 0; -- cgit v1.2.3