From 747b7119ae89a3ccaceeae4f5570c7ab83d2cf5d Mon Sep 17 00:00:00 2001 From: Panu Matilainen Date: Tue, 1 Sep 2020 13:14:35 +0300 Subject: [PATCH] Fix possible read beyond buffer in rstrnlenhash() On strings that are not \0-terminated (which are a big reason for the existence of this function), the while-loop would try to compare the first character beyond the specified buffer for '\0' before realizing we're already beyond the end when checking n. Should be mostly harmless in practise as the check for n would still terminate it, but not right. In particular this trips up address sanitizer with the bdb backend where some of the returned strings are not \0-terminated. Test for string length first, and move the decrementing side-effect into the loop for better readability. --- rpmio/rpmstrpool.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rpmio/rpmstrpool.c b/rpmio/rpmstrpool.c index 776ca6dea..0db0b5313 100644 --- a/rpmio/rpmstrpool.c +++ b/rpmio/rpmstrpool.c @@ -88,11 +88,12 @@ static inline unsigned int rstrnlenhash(const char * str, size_t n, size_t * len unsigned int hash = 0xe4721b68; const char * s = str; - while (*s != '\0' && n-- > 0) { + while (n > 0 && *s != '\0') { hash += *s; hash += (hash << 10); hash ^= (hash >> 6); s++; + n--; } hash += (hash << 3); hash ^= (hash >> 11); -- 2.27.0