niansa-misc/musl
1
0
Fork 0
mirror of git://git.musl-libc.org/musl synced 2025-03-06 20:48:29 +01:00
Code Issues Projects Releases Packages Wiki Activity

harden mo file processing for locale/translations

Browse source 
rather than just checking that the start of the string lies within the
mapping, also check that the nominal length remains within the
mapping, and that the null terminator is present at the nominal
length. this ensures that the caller, using the result as a C string,
will not read past the end of the mapping.

the nominal length is never exposed to the caller, but it's useful
internally to find where the null terminator should be without having
to restort to linear search via strnlen/memchr.
This commit is contained in:
Rich Felker 2014-07-29 11:48:36 -04:00
parent 73d2a3bfda
commit 6e89210669
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/locale/__mo_lookup.c
View file

@ -18,12 +18,16 @@ const char *__mo_lookup(const void *p, size_t size, const char *s)
o/=4;
t/=4;
for (;;) {
uint32_t ol = swapc(mo[o+2*(b+n/2)], sw);
uint32_t os = swapc(mo[o+2*(b+n/2)+1], sw);
if (os >= size) return 0;
if (os >= size || ol >= size-os || ((char *)p)[os+ol])
return 0;
int sign = strcmp(s, (char *)p + os);
if (!sign) {
uint32_t tl = swapc(mo[t+2*(b+n/2)], sw);
uint32_t ts = swapc(mo[t+2*(b+n/2)+1], sw);
if (ts >= size) return 0;
if (ts >= size || tl >= size-ts || ((char *)p)[ts+tl])
return 0;
return (char *)p + ts;
}
else if (n == 1) return 0;