emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ed: don't use memcpy with overlapping memory regions

Browse Source 
The memcpy invocations in the subCommand function, modified by this
commit, previously used memcpy with overlapping memory regions. This is
undefined behavior. On Alpine Linux, it causes BusyBox ed to crash since
we compile BusyBox with -D_FORTIFY_SOURCE=2 and our fortify-headers
implementation catches this source of undefined behavior [0]. The issue
can only be triggered if the replacement string is the same size or
shorter than the old string.

Looking at the code, it seems to me that a memmove(3) is what was
actually intended here, this commit modifies the code accordingly.

[0]: https://gitlab.alpinelinux.org/alpine/aports/-/issues/13504

Signed-off-by: Sören Tempel <soeren+git@soeren-tempel.net>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Sören Tempel 2022-02-08 20:29:30 +01:00 committed by Denys Vlasenko
parent 70f77e4617
commit f15dfd86c4
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
editors/ed.c
View File

@ -720,7 +720,7 @@ static void subCommand(const char *cmd, int num1, int num2)
if (deltaLen <= 0) { if (deltaLen <= 0) {
memcpy(&lp->data[offset], newStr, newLen); memcpy(&lp->data[offset], newStr, newLen);
if (deltaLen) { if (deltaLen) {
memcpy(&lp->data[offset + newLen], memmove(&lp->data[offset + newLen],
&lp->data[offset + oldLen], &lp->data[offset + oldLen],
lp->len - offset - oldLen); lp->len - offset - oldLen);