Re: [PATCH] input: Fix heap-buffer-overflow in preadbuffer on long lines

Tiago de Paula <[email protected]> wrote:
> Update lleft before calling preadfd so buffered data is preserved
> when refilling the buffer during long line scanning, preventing
> out-of-bounds reads.
> 
> Fixes: a065467315dc ("input: Move newline loop into preadbuffer")
> Signed-off-by: Tiago de Paula <[email protected]>
> ---
> I discovered this via perlbrew: config.sh contained a single
> 'cppsymbols=...' line that was 12502 characters long. The issue
> can be replicated with:
> 
>    python -c 'print("VAR=" + "a"*8300)' > repro.sh
>    dash repro.sh
> 
> AddressSanitizer reports a heap-buffer-overflow in preadbuffer(),
> which led to me this fix.
> 
> src/input.c | 1 +
> 1 file changed, 1 insertion(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt