{{ message }}
Repository navigation
Commit 5b25cdb
committed
hexdump: fix out-of-bounds read in %s conversion
get() allocates exactly blocksize bytes for the I/O buffer, but the %s
conversion prints a NUL-terminated string starting inside the block.
When the block is completely filled with non-NUL data, printf() scans
past the end of the buffer and leaks adjacent heap memory into the
output (and reads out of bounds).
Allocate one extra byte (zeroed by calloc) so that the block is always
NUL-terminated.
Reproducer (the '!' bytes are heap metadata read past the buffer):
printf 'ABCDEFGHIJKLMNOPQRSTUVWX' > /tmp/f24
hexdump -e '24/1 "%s"' /tmp/f24
before: ...ABCDEFGHIJKLMNOPQRSTUVWX!BCDEFGHIJKLMNOPQRSTUVWX!...
after: ...ABCDEFGHIJKLMNOPQRSTUVWXBCDEFGHIJKLMNOPQRSTUVWX...
Signed-off-by: zhanghongyuan <zhanghongyuan@uniontech.com>1 parent 750b8ba commit 5b25cdb
1 file changed
Lines changed: 4 additions & 2 deletions
0 commit comments