[PATCH] input: Fix heap-buffer-overflow in preadbuffer on long lines
Tiago de Paula <[email protected]> Wed, 11 Feb 2026 23:29:44 -0800
| Newsgroups | org.kernel.vger.dash |
|---|---|
| Message-ID | <CAO_NRt5mv7E-qkSA2hE+4HsQMzpczrF9ZAWL-jKbW0Li1F3U0A@mail.gmail.com> |
Update lleft before calling preadfd so buffered data is preserved
when refilling the buffer during long line scanning, preventing
out-of-bounds reads.
Fixes: a065467315dc ("input: Move newline loop into preadbuffer")
Signed-off-by: Tiago de Paula <[email protected]>
---
I discovered this via perlbrew: config.sh contained a single
'cppsymbols=...' line that was 12502 characters long. The issue
can be replicated with:
python -c 'print("VAR=" + "a"*8300)' > repro.sh
dash repro.sh
AddressSanitizer reports a heap-buffer-overflow in preadbuffer(),
which led to me this fix.
src/input.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/input.c b/src/input.c
index c36d120..3467bd1 100644
--- a/src/input.c
+++ b/src/input.c
@@ -386,6 +386,7 @@ eof:
again:
nr = q - parsefile->nextc;
+ input_set_lleft(parsefile, nr);
more = preadfd();
q = parsefile->nextc + nr;
if (more <= 0) {
--
2.53.0