[PATCH] expand: Use memmove when copying multi-byte chars in rmescapes

Aleksander Ushakov <[email protected]> wrote:
> Dear Dash maintainers,
> 
> I encountered a bug in Dash 0.5.13 and would like to report
> it. The behaviour is the same for ASAN error in Dash 0.5.12 and I
> reported it here (https://www.spinics.net/lists/dash/msg02856.html).
> So steps to reproduce are similarly for 0.5.12 and 0.5.13. The ASAN
> errors have some differences but the problem may be the same. The
> details are  provided below.
> 
> ==4385==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges
> [0x5e9360717719,0x5e936071771c) and [0x5e936071771b, 0x5e936071771e)
> overlap
>    #0 0x5e935fced469 in __asan_memcpy
> (/upstream/z/dash-0.5.13/src/dash+0xd6469) (BuildId:
> e987025fc7a0e719d6f6413a475e27117a9dee0e)
>    #1 0x5e935fd40db9 in _rmescapes /upstream/z/dash-0.5.13/src/expand.c:2129:8

Thanks for the report.  I'll change the memcpy to memmove.

---8<---
Use memmove instead of mempcpy in rmescapes as the two regions
can indeed overlap when escaps are removed in place.

Fixes: 990bbd15346d ("expand: Process multi-byte characters in subevalvar")
Reported-by: Aleksander Ushakov <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>

diff --git a/src/expand.c b/src/expand.c
index eed8150..bbf8454 100644
--- a/src/expand.c
+++ b/src/expand.c
@@ -2128,7 +2128,8 @@ _rmescapes(char *str, int flag)
 				tail = 0;
 			}
 
-			q = mempcpy(q, p, ml);
+			memmove(q, p, ml);
+			q += ml;
 			p += ml + tail;
 			goto setnesc;
 		}
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt