aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2001-07-27 19:09:19 +0000
committerUlrich Drepper <drepper@redhat.com>2001-07-27 19:09:19 +0000
commit519ba0a378bb40b18acaca7d45451cf936dfa350 (patch)
tree6963ecea44928bf1dc7fb64967253ae2011d7a76
parent277f8cdf9849ec2d701b17dab05199e8fe044b89 (diff)
downloadglibc-519ba0a378bb40b18acaca7d45451cf936dfa350.zip
glibc-519ba0a378bb40b18acaca7d45451cf936dfa350.tar.gz
glibc-519ba0a378bb40b18acaca7d45451cf936dfa350.tar.bz2
Update.
* libio/vasprintf.c (_IO_vasprintf): Don't copy uninitialized byte from stream buffer to result buffer. Reported by Michael Meeks <michael@ximian.com>.
-rw-r--r--ChangeLog4
-rw-r--r--libio/vasprintf.c6
2 files changed, 7 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index 8bd3b9d..0f22d79 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
2001-07-27 Ulrich Drepper <drepper@redhat.com>
+ * libio/vasprintf.c (_IO_vasprintf): Don't copy uninitialized byte
+ from stream buffer to result buffer.
+ Reported by Michael Meeks <michael@ximian.com>.
+
* libio/Makefile: Add rules to check output of tst-fopenloc and
for memory leaks.
* libio/tst-fopenloc.c: New file.
diff --git a/libio/vasprintf.c b/libio/vasprintf.c
index c683911..852de23 100644
--- a/libio/vasprintf.c
+++ b/libio/vasprintf.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1995, 1997, 1999, 2000 Free Software Foundation, Inc.
+/* Copyright (C) 1995, 1997, 1999, 2000, 2001 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
@@ -74,7 +74,7 @@ _IO_vasprintf (result_ptr, format, args)
*result_ptr = (char *) malloc (needed);
if (*result_ptr != NULL)
{
- memcpy (*result_ptr, sf._sbf._f._IO_buf_base, needed);
+ memcpy (*result_ptr, sf._sbf._f._IO_buf_base, needed - 1);
free (sf._sbf._f._IO_buf_base);
}
else
@@ -83,7 +83,7 @@ _IO_vasprintf (result_ptr, format, args)
}
if (*result_ptr == NULL)
*result_ptr = sf._sbf._f._IO_buf_base;
- (*result_ptr)[sf._sbf._f._IO_write_ptr-sf._sbf._f._IO_write_base] = '\0';
+ (*result_ptr)[needed - 1] = '\0';
return ret;
}