Re: [BUG] heap-buffer-overflow(read) padvance_magic() exec.c:232:8

Aleksander Ushakov <[email protected]> wrote:
> Hello Dash maintainers,
> 
> I encountered a bug in Dash in commit b4ef25d7 and would like to report
> it. The details are provided below.
> =================================================================
> ==19628==ERROR: AddressSanitizer: heap-buffer-overflow on address 
> 0x5020000001f6 at pc 0x653a8d802916 bp 0x7ffd57f3d590 sp 0x7ffd57f3cd50
> READ of size 2 at 0x5020000001f6 thread T0
>     #0 0x653a8d802915 in strcspn (/upstream/dash/src/dash+0x55915) 
> (BuildId: 82ec7cbb990c5349f280ce0bf016a1bca211dffd)
>     #1 0x653a8d8d01af in padvance_magic /upstream/dash/src/exec.c:232:8

This may be a false positive, or strcspn is buggy.  padvance_magic
actually passes vpath.text + 5 to strcspn, and as vpath.text[5] is
NUL, there is no reason for strcspn to read vpath.text + 6.

Cheers,
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt