diff options
| author | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2022-06-21 15:57:48 +0100 |
|---|---|---|
| committer | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2022-10-28 11:15:28 +0100 |
| commit | 3fa20d59d9607e4494dfbc99bacee1935ec5ded9 (patch) | |
| tree | 87cf7e511ad53f1ec4a1cbcc63e8b77fababc8d1 /debug | |
| parent | e5ece9de1417ac33c755226f3dd962fc2c7d97aa (diff) | |
| download | glibc-3fa20d59d9607e4494dfbc99bacee1935ec5ded9.zip glibc-3fa20d59d9607e4494dfbc99bacee1935ec5ded9.tar.gz glibc-3fa20d59d9607e4494dfbc99bacee1935ec5ded9.tar.bz2 | |
Fix invalid pointer dereference in wcpcpy_chk
The src pointer is const and points to a different object, so accessing
dest via src is invalid.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Diffstat (limited to 'debug')
| -rw-r--r-- | debug/wcpcpy_chk.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/debug/wcpcpy_chk.c b/debug/wcpcpy_chk.c index bc2be43..d44fb47 100644 --- a/debug/wcpcpy_chk.c +++ b/debug/wcpcpy_chk.c @@ -28,13 +28,12 @@ __wcpcpy_chk (wchar_t *dest, const wchar_t *src, size_t destlen) { wchar_t *wcp = (wchar_t *) dest - 1; wint_t c; - const ptrdiff_t off = src - dest + 1; do { if (__glibc_unlikely (destlen-- == 0)) __chk_fail (); - c = wcp[off]; + c = *src++; *++wcp = c; } while (c != L'\0'); |