shithub: trueawk

Download patch

ref: 22ee26b925f0c93b3539efd2e195af74bdf34fac
parent: b82b649aa65fbdff45869d1fd6d72fd2b85946cd
author: Todd C. Miller <Todd.Miller@sudo.ws>
date: Wed Jul 29 08:27:45 EDT 2020

Cast to uschar when storing a char in an int that will be used as an index (#88)

* Cast to uschar when storing a char in an int that will be used as an index.
Fixes a heap underflow when the input char has the high bit set and
FS is a regex.

* Add regress test for underflow when RS is a regex and input is 8-bit.

--- a/b.c
+++ b/b.c
@@ -684,7 +684,7 @@
 						FATAL("stream '%.30s...' too long", buf);
 				buf[k++] = (c = getc(f)) != EOF ? c : 0;
 			}
-			c = buf[j];
+			c = (uschar)buf[j];
 			/* assert(c < NCHARS); */
 
 			if ((ns = pfa->gototab[s][c]) != 0)
--- /dev/null
+++ b/bugs-fixed/rs_underflow.awk
@@ -1,0 +1,1 @@
+BEGIN { RS="zx" } { print $1 }
--- /dev/null
+++ b/bugs-fixed/rs_underflow.in
@@ -1,0 +1,1 @@
+�
--- /dev/null
+++ b/bugs-fixed/rs_underflow.ok
@@ -1,0 +1,1 @@
+�
--- a/lex.c
+++ b/lex.c
@@ -148,7 +148,7 @@
 		strtod(buf, &rem);	/* parse the number */
 		if (rem == buf) {	/* it wasn't a valid number at all */
 			buf[1] = 0;	/* return one character as token */
-			retc = buf[0];	/* character is its own type */
+			retc = (uschar)buf[0];	/* character is its own type */
 			unputstr(rem+1); /* put rest back for later */
 		} else {	/* some prefix was a number */
 			unputstr(rem);	/* put rest back for later */
--