XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-04-14 17:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

os: fix pnprintf OOB buffer read for unterminated length modifiers

Browse Source 
Format strings with length modifiers but missing format specifier like "%0"
will read one byte past the array size.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
Peter Hutterer
2013-02-14 16:31:13 +10:00
committed by Keith Packard
parent 955d434f4d
commit 9a35d4240e
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
test/signal-logging.c
View File

@@ -199,6 +199,14 @@ static void logging_format(void)
read_log_msg(logmsg);
assert(strcmp(logmsg, "(EE) substituted string\n") == 0);
/* Invalid format */
#warning Ignore compiler warning below "lacks type at end of format". This is intentional.
LogMessageVerbSigSafe(X_ERROR, -1, "%4", 4);
read_log_msg(logmsg);
assert(strcmp(logmsg, "(EE) ") == 0);
LogMessageVerbSigSafe(X_ERROR, -1, "\n");
fseek(f, 0, SEEK_END);
/* number substitution */
ui = 0;
do {