d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid OOB reads in memmem(3).

Browse Source 
commit 51bdcdc424bd7169c8cccdc2de7cad17f5ea0f70
Author: Alexander Monakov <amonakov@ispras.ru>
Date:   Fri Jun 30 00:35:33 2017 +0300

    fix OOB reads in Xbyte_memmem

    Reported by Leah Neukirchen.

Reviewed by:	emaste
Approved by:	re (kib)
This commit is contained in:
Gleb Smirnoff 2018-10-15 20:20:57 +00:00
parent 03da20c5fa
commit 9004dbddea
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=339370
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/libc/string/memmem.c
View File

@ -31,27 +31,27 @@ __FBSDID("$FreeBSD$");
static char *twobyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
{
uint16_t nw = n[0]<<8 | n[1], hw = h[0]<<8 | h[1];
for (h++, k--; k; k--, hw = hw<<8 | *++h)
if (hw == nw) return (char *)h-1;
return 0;
for (h+=2, k-=2; k; k--, hw = hw<<8 | *h++)
if (hw == nw) return (char *)h-2;
return hw == nw ? (char *)h-2 : 0;
}
static char *threebyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
{
uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8;
uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8;
for (h+=2, k-=2; k; k--, hw = (hw|*++h)<<8)
if (hw == nw) return (char *)h-2;
return 0;
for (h+=3, k-=3; k; k--, hw = (hw|*h++)<<8)
if (hw == nw) return (char *)h-3;
return hw == nw ? (char *)h-3 : 0;
}
static char *fourbyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
{
uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
for (h+=3, k-=3; k; k--, hw = hw<<8 | *++h)
if (hw == nw) return (char *)h-3;
return 0;
for (h+=4, k-=4; k; k--, hw = hw<<8 | *h++)
if (hw == nw) return (char *)h-4;
return hw == nw ? (char *)h-4 : 0;
}
#define MAX(a,b) ((a)>(b)?(a):(b))