diff options
| author | Pádraig Brady <P@draigBrady.com> | 2026-04-28 20:33:10 +0100 |
|---|---|---|
| committer | Pádraig Brady <P@draigBrady.com> | 2026-04-29 13:16:43 +0100 |
| commit | b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d (patch) | |
| tree | f7f139bd69bacd6525e190584407d3749897a40c /src | |
| parent | 00cd91288cce5e781dbc750e85ef00a74bc49def (diff) | |
| download | coreutils-b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d.tar.gz coreutils-b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d.zip | |
unexpand: fix heap overflow
* src/unexpand.c (unexpand): Use xinmalloc() to gracefully
handle overflow. Also use the runtime locale specific MB_CUR_MAX
rather than the worst case MB_LEN_MAX.
* tests/unexpand/mb.sh: Add a test case that fails in a default
glibc build with either MB_CUR_MAX or MB_LEN_MAX.
* NEWS: Mention the bug fix.
Reported by Michał Majchrowicz.
Diffstat (limited to 'src')
| -rw-r--r-- | src/unexpand.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/unexpand.c b/src/unexpand.c index 3cbff1b12..c859c17a3 100644 --- a/src/unexpand.c +++ b/src/unexpand.c @@ -131,7 +131,7 @@ unexpand (void) /* The worst case is a non-blank character, then one blank, then a tab stop, then MAX_COLUMN_WIDTH - 1 blanks, then a non-blank; so allocate MAX_COLUMN_WIDTH bytes to store the blanks. */ - pending_blank = ximalloc (max_column_width * sizeof (char) * MB_LEN_MAX); + pending_blank = xinmalloc (max_column_width, MB_CUR_MAX); while (true) { |