41 lines
1.4 KiB
Diff
41 lines
1.4 KiB
Diff
|
From 747b7119ae89a3ccaceeae4f5570c7ab83d2cf5d Mon Sep 17 00:00:00 2001
|
||
|
|
From: Panu Matilainen <pmatilai@redhat.com>
|
||
|
|
Date: Tue, 1 Sep 2020 13:14:35 +0300
|
||
|
|
Subject: [PATCH] Fix possible read beyond buffer in rstrnlenhash()
|
||
|
|
|
||
|
|
On strings that are not \0-terminated (which are a big reason for the
|
||
|
|
existence of this function), the while-loop would try to compare the
|
||
|
|
first character beyond the specified buffer for '\0' before realizing
|
||
|
|
we're already beyond the end when checking n. Should be mostly harmless
|
||
|
|
in practise as the check for n would still terminate it, but not right.
|
||
|
|
In particular this trips up address sanitizer with the bdb backend where
|
||
|
|
some of the returned strings are not \0-terminated.
|
||
|
|
|
||
|
|
Test for string length first, and move the decrementing side-effect into
|
||
|
|
the loop for better readability.
|
||
|
|
---
|
||
|
|
rpmio/rpmstrpool.c | 3 ++-
|
||
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/rpmio/rpmstrpool.c b/rpmio/rpmstrpool.c
|
||
|
|
index 776ca6dea..0db0b5313 100644
|
||
|
|
--- a/rpmio/rpmstrpool.c
|
||
|
|
+++ b/rpmio/rpmstrpool.c
|
||
|
|
@@ -88,11 +88,12 @@ static inline unsigned int rstrnlenhash(const char * str, size_t n, size_t * len
|
||
|
|
unsigned int hash = 0xe4721b68;
|
||
|
|
const char * s = str;
|
||
|
|
|
||
|
|
- while (*s != '\0' && n-- > 0) {
|
||
|
|
+ while (n > 0 && *s != '\0') {
|
||
|
|
hash += *s;
|
||
|
|
hash += (hash << 10);
|
||
|
|
hash ^= (hash >> 6);
|
||
|
|
s++;
|
||
|
|
+ n--;
|
||
|
|
}
|
||
|
|
hash += (hash << 3);
|
||
|
|
hash ^= (hash >> 11);
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|