Re: Commit: Fix CVE-2026-19582

Nick Clifton writes:
> Hi Andreas,
>
>>>    The fix I have chosen is to change the buffer into a rsrc_string
>>>    structure and to use this to keep track of the space remaining whilst
>>>    constructing the error message.  Which is a lot of faff for a case
>>>    that will almost certainly never arise.  But hey ho, the bug has
>>>    been reported and now it is fixed.
>> Wouldn't it be easier to use bfd_asprintf?
>
> In hindsight - maybe ?  The problem with bfd_asprintf() and similar
> functions is that they do not handle incremental string construction well.
> The rsrc_resource_name() function constructs the error message piecemeal,
> appending more and more text to a string buffer as it parses the resource.
> So in order to use them we would have to reuse the allocated buffer in
> successive calls, eg:
>
>   char * msg = bfd_asprintf ("part one");
>   msg = bfd_asprintf ("%s %s", msg, "part two");
>   msg = bfd_asprintf ("%s %s", msg, "part three");
>
> This should work I think, but it does also seem wasteful of memory.

Wouldn't msg get free'd before you get the chance to use it as an
argument?  You'd want a function that used a passed-in buffer to append
something at the end instead (while keeping the buffer from
overflowing).


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Factory and User Sound Singles for Waldorf Q+, Q and microQ:
http://Synth.Stromeko.net/Downloads.html#WaldorfSounds