svn commit: r338995 - stable/11/bin/sh
Jilles Tjoelker
jilles at FreeBSD.org
Fri Sep 28 12:29:54 UTC 2018
Author: jilles
Date: Fri Sep 28 12:29:53 2018
New Revision: 338995
URL: https://svnweb.freebsd.org/changeset/base/338995
Log:
MFC r338473: sh: Fix formal overflow in pointer arithmetic
The intention is to lower the value of the pointer, which according to ubsan
cannot be done by adding an unsigned quantity.
Reported by: kevans
Modified:
stable/11/bin/sh/expand.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/bin/sh/expand.c
==============================================================================
--- stable/11/bin/sh/expand.c Fri Sep 28 11:57:40 2018 (r338994)
+++ stable/11/bin/sh/expand.c Fri Sep 28 12:29:53 2018 (r338995)
@@ -896,7 +896,7 @@ reprocess(int startloc, int flag, int subtype, int quo
startp = stackblock() + startloc;
len = expdest - startp;
- if (len >= SIZE_MAX / 2)
+ if (len >= SIZE_MAX / 2 || len > PTRDIFF_MAX)
abort();
INTOFF;
if (len >= buflen) {
@@ -912,7 +912,7 @@ reprocess(int startloc, int flag, int subtype, int quo
INTON;
memcpy(buf, startp, len);
buf[len] = '\0';
- STADJUST(-len, expdest);
+ STADJUST(-(ptrdiff_t)len, expdest);
for (zpos = 0;;) {
zlen = strlen(buf + zpos);
strtodest(buf + zpos, flag, subtype, quoted, dst);
More information about the svn-src-all
mailing list