bug#79555: unexpand: heap-buffer-overflow
Frank Busse <[email protected]>
| Newsgroups | gmane.comp.gnu.core-utils.bugs |
|---|---|
| Organization | Imperial College London |
| Message-ID | <[email protected]> |
Hi,
KLEE found another bug in Coreutils 9.8:
$ printf '\x00\x08\x08\t ' | unexpand '-3t +/ +6,'
ASAN confirms:
---
==516254==ERROR: heap-buffer-overflow
WRITE of size 1 at 0x7bd06c1e01f3 thread T0
#0 0x55fbf2552614 in unexpand src/unexpand.c:195
#1 0x55fbf2552614 in main src/unexpand.c:316
...
---
Kind regards,
Frank