diff options
| author | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2022-10-11 14:57:16 +0100 |
|---|---|---|
| committer | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2022-10-28 11:16:51 +0100 |
| commit | b866018f54ad0670ee9b930a14ae6e8960b9f4bf (patch) | |
| tree | 7ea12d46c1f7fcf6fb48b31a697b904accfeaffc /stdio-common | |
| parent | 6a3794ea917558776ba1a66a925f2d5e1dbf0724 (diff) | |
| download | glibc-b866018f54ad0670ee9b930a14ae6e8960b9f4bf.zip glibc-b866018f54ad0670ee9b930a14ae6e8960b9f4bf.tar.gz glibc-b866018f54ad0670ee9b930a14ae6e8960b9f4bf.tar.bz2 | |
Fix missing NUL terminator in stdio-common/scanf13 test
sscanf is only defined on nul terminated string input, but '\0' was
missing in this test which caused _IO_str_init_static_internal to
read OOB on the stack when computing the bounds of the string.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Diffstat (limited to 'stdio-common')
| -rw-r--r-- | stdio-common/scanf13.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/stdio-common/scanf13.c b/stdio-common/scanf13.c index 720224a..60aa62a 100644 --- a/stdio-common/scanf13.c +++ b/stdio-common/scanf13.c @@ -67,6 +67,7 @@ main (void) buf[2049] = 0x84; buf[2058] = '\t'; buf[2059] = 'a'; + buf[sizeof (buf) - 1] = '\0'; if (sscanf (buf, "%ms%mc", &sp1, &sp2) != 2) FAIL (); else |