d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sh: Fix formal overflow in pointer arithmetic

Browse Source 
The intention is to lower the value of the pointer, which according to ubsan
cannot be done by adding an unsigned quantity.

Reported by:	kevans
Approved by:	re (kib)
MFC after:	1 week
This commit is contained in:
Jilles Tjoelker 2018-09-05 19:16:09 +00:00
parent ce9eea6425
commit 4269bba2eb
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bin/sh/expand.c
View File

@ -896,7 +896,7 @@ reprocess(int startloc, int flag, int subtype, int quoted,
startp = stackblock() + startloc;
len = expdest - startp;
if (len >= SIZE_MAX / 2)
if (len >= SIZE_MAX / 2 || len > PTRDIFF_MAX)
abort();
INTOFF;
if (len >= buflen) {
@ -912,7 +912,7 @@ reprocess(int startloc, int flag, int subtype, int quoted,
INTON;
memcpy(buf, startp, len);
buf[len] = '\0';
STADJUST(-len, expdest);
STADJUST(-(ptrdiff_t)len, expdest);
for (zpos = 0;;) {
zlen = strlen(buf + zpos);
strtodest(buf + zpos, flag, subtype, quoted, dst);