[PATCH] input: Fix heap-buffer-overflow in preadbuffer on long lines

Tiago de Paula <[email protected]> Wed, 11 Feb 2026 23:29:44 -0800
Newsgroups org.kernel.vger.dash
Message-ID <CAO_NRt5mv7E-qkSA2hE+4HsQMzpczrF9ZAWL-jKbW0Li1F3U0A@mail.gmail.com>
Update lleft before calling preadfd so buffered data is preserved
when refilling the buffer during long line scanning, preventing
out-of-bounds reads.

Fixes: a065467315dc ("input: Move newline loop into preadbuffer")
Signed-off-by: Tiago de Paula <[email protected]>
---
I discovered this via perlbrew: config.sh contained a single
'cppsymbols=...' line that was 12502 characters long. The issue
can be replicated with:

    python -c 'print("VAR=" + "a"*8300)' > repro.sh
    dash repro.sh

AddressSanitizer reports a heap-buffer-overflow in preadbuffer(),
which led to me this fix.

 src/input.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/input.c b/src/input.c
index c36d120..3467bd1 100644
--- a/src/input.c
+++ b/src/input.c
@@ -386,6 +386,7 @@ eof:

 again:
 		nr = q - parsefile->nextc;
+		input_set_lleft(parsefile, nr);
 		more = preadfd();
 		q = parsefile->nextc + nr;
 		if (more <= 0) {
-- 
2.53.0