[PATCH 2/2] expand: pmatch(): Fix buffer overread caused by passing array of chars as string
Zurab Kvachadze <[email protected]> Tue, 29 Apr 2025 23:47:32 +0200
| Newsgroups | org.kernel.vger.dash |
|---|---|
| Message-ID | <[email protected]> |
strpbrk() accepts two null-terminated string arguments. stop[] is char array that is not null-terminated but is still passed as a second argument to strpbrk. This causes buffer overread, which is detected by AddressSanitizer. This commit adds an explicit null-terminated to the end of the array. Signed-off-by: Zurab Kvachadze <[email protected]> --- src/expand.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/expand.c b/src/expand.c index 171c135..8cff60d 100644 --- a/src/expand.c +++ b/src/expand.c @@ -1890,7 +1890,9 @@ static __attribute__((noinline)) int ccmatch(char *p, const char *mbc, int ml, static int pmatch(char *pattern, const char *string) { - char stop[] = { 0, CTLESC, CTLMBCHAR }; + /* stop should be null-terminated as it passed as a string to + * strpbrk. */ + char stop[] = { 0, CTLESC, CTLMBCHAR, '\0' }; const char *q; unsigned mb; char *p; -- 2.45.3