Skip to content

Commit 171ba6d

Browse files
navi-desuwilliamh
authored andcommitted
librc: Use proper string length in file_regex.
Currently the code uses the total size of the buffer as the bounds for looping \0 separated fields, which leads to reading uninitialized data and possibly overrun the buffer during regexec. Observed on musl while matching /proc/cpuinfo.
1 parent 8cafbb7 commit 171ba6d

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

src/librc/librc.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ file_regex(const char *file, const char *regex)
175175
{
176176
FILE *fp;
177177
char *line = NULL;
178-
size_t len = 0;
178+
size_t size = 0, len = 0;
179179
regex_t re;
180180
bool retval = true;
181181
int result;
@@ -192,7 +192,7 @@ file_regex(const char *file, const char *regex)
192192
return false;
193193
}
194194

195-
while ((rc_getline(&line, &len, fp))) {
195+
while ((len = rc_getline(&line, &size, fp))) {
196196
char *str = line;
197197
/* some /proc files have \0 separated content so we have to
198198
loop through the 'line' */

0 commit comments

Comments
 (0)