diff options
| author | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2022-10-11 14:57:16 +0100 |
|---|---|---|
| committer | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2022-10-27 14:46:48 +0100 |
| commit | b30fd928ac8f272dccb232cea47233c03f8f142d (patch) | |
| tree | acc3fcc110fcd041a0f1957ed0966be91cb8fdf8 /stdio-common | |
| parent | 1dc3098e2c316254d6a9cb50797f2eca9be92b9f (diff) | |
| download | glibc-b30fd928ac8f272dccb232cea47233c03f8f142d.tar glibc-b30fd928ac8f272dccb232cea47233c03f8f142d.tar.gz glibc-b30fd928ac8f272dccb232cea47233c03f8f142d.tar.bz2 glibc-b30fd928ac8f272dccb232cea47233c03f8f142d.zip | |
Fix missing NUL terminator in stdio-common/scanf13 test
sscanf is only defined on nul terminated string input, but '\0' was
missing in this test which caused _IO_str_init_static_internal to
read OOB on the stack when computing the bounds of the string.
Diffstat (limited to 'stdio-common')
| -rw-r--r-- | stdio-common/scanf13.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/stdio-common/scanf13.c b/stdio-common/scanf13.c index 720224aa05..60aa62a26f 100644 --- a/stdio-common/scanf13.c +++ b/stdio-common/scanf13.c @@ -67,6 +67,7 @@ main (void) buf[2049] = 0x84; buf[2058] = '\t'; buf[2059] = 'a'; + buf[sizeof (buf) - 1] = '\0'; if (sscanf (buf, "%ms%mc", &sp1, &sp2) != 2) FAIL (); else |