musl - musl - an implementation of the standard library for Linux-based systems

musl - an implementation of the standard library for Linux-based systems

diff options

author	Rich Felker <dalias@aerifal.cx>	2018年07月13日 21:56:27 -0400
committer	Rich Felker <dalias@aerifal.cx>	2018年07月13日 21:56:27 -0400
commit	9cad27a3dc1a4eb349b6591e4dc8cc89dce32277 (patch)
tree	9346b3dd848090b935d466385c006fdd86263ceb /src/stdio/setvbuf.c
parent	062015204a192dd6ab9663abcc3171b9106d1749 (diff)
download	musl-9cad27a3dc1a4eb349b6591e4dc8cc89dce32277.tar.gz

fix writes outside buffer by ungetc after setvbuf

commit 0b80a7b0404b6e49b0b724e3e3fe0ed5af3b08ef, which added non-stub setvbuf, applied the UNGET pushback adjustment to the size of the buffer passed in, but inadvertently omitted offsetting the start by the same amount, thereby allowing unget to clobber up to 8 bytes before the start of the buffer. this bug was introduced in the present release cycle; no releases are affected.

Diffstat (limited to 'src/stdio/setvbuf.c')

-rw-r--r--

src/stdio/setvbuf.c

1 files changed, 1 insertions, 1 deletions

diff --git a/src/stdio/setvbuf.c b/src/stdio/setvbuf.c
index b6b9b018..06ea296c 100644
--- a/src/stdio/setvbuf.c
+++ b/src/stdio/setvbuf.c

@@ -14,7 +14,7 @@ int setvbuf(FILE *restrict f, char *restrict buf, int type, size_t size)

f->buf_size = 0;

} else {

if (buf && size >= UNGET) {

- f->buf = (void *)buf;

+ f->buf = (void *)(buf + UNGET);

f->buf_size = size - UNGET;

}

if (type == _IOLBF && f->buf_size)

generated by cgit v1.2.1 (git 2.18.0) at 2025年09月09日 19:18:46 +0000