[Rpm-maint] [rpm-software-management/rpm] Avoid incrementing a pointer past the end (#1489)

Demi Marie Obenour notifications at github.com
Wed Feb 17 02:26:08 UTC 2021


base64-encoded test case below.  This doesn’t trip any of the sanitizers, but I did check that it called `memchr` with a pointer one-past-the-end:

```
AAAACAAAAIgAAAA+AAAABwAAAAAAAAAQAJgAAAAAAAcAAAAAAAAAEACYAAAAAAAAAAAAAADCAAAA
AAAAAAAACAQAAAAEAAAAAAAACAAAAAQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMIAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAiAAAAD4AAAAHgAAAAAAAABAAAAAAAAAAAAAAAAAAwgAAAAAA
AP8AAAAAAAAAAAAAAADCAAAAAAAIBAAAAAAA/wAAhwAAAAAAALTwKwEgYQAAAAAAAAAAAAAAAAAA
AAAAAAAAAAACAAAAAAAAAAAAAAAAAAAALwgAAAAAAAAAAAAAAAAAAAAAAAA=
```

While this change (which reduces the amount of code) is probably a good idea anyway, we might also want to wrap `memcmp`, `memchr`, and other such functions with `static inline` wrappers that avoid this problem.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1489#issuecomment-780252290
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20210216/802a0bab/attachment-0001.html>


More information about the Rpm-maint mailing list