From 0a520f28ffc8820d46074a71323db4c9652873be Mon Sep 17 00:00:00 2001 From: Szabolcs Nagy Date: Mon, 26 Sep 2022 15:38:19 +0100 Subject: Fix off-by-one OOB write in iconv/tst-iconv-mt The iconv buffer sizes must not include the \0 string terminator. And the output termination with *outbufpos = '\0' was OOB. Consistently use non-null-terminated buffer sizes. Reviewed-by: Adhemerval Zanella --- iconv/tst-iconv-mt.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/iconv/tst-iconv-mt.c b/iconv/tst-iconv-mt.c index e634eec1b7..8d7867b323 100644 --- a/iconv/tst-iconv-mt.c +++ b/iconv/tst-iconv-mt.c @@ -57,12 +57,13 @@ worker (void * arg) iconv_t cd; char ascii[] = CONV_INPUT; + size_t bytes = sizeof (CONV_INPUT) - 1; char *inbufpos = ascii; - size_t inbytesleft = sizeof (CONV_INPUT); + size_t inbytesleft = bytes; - char *utf8 = xcalloc (sizeof (CONV_INPUT), 1); + char *utf8 = xcalloc (bytes, 1); char *outbufpos = utf8; - size_t outbytesleft = sizeof (CONV_INPUT); + size_t outbytesleft = bytes; if (tidx < TCOUNT/2) /* The first half of the worker thread pool synchronize together here, @@ -91,8 +92,6 @@ worker (void * arg) &outbytesleft) != (size_t) -1); - *outbufpos = '\0'; - xpthread_barrier_wait (&sync); TEST_VERIFY_EXIT (iconv_close (cd) == 0); @@ -104,11 +103,7 @@ worker (void * arg) if (tidx < TCOUNT/2) xpthread_barrier_wait (&sync); - if (strncmp (utf8, CONV_INPUT, sizeof CONV_INPUT)) - { - printf ("FAIL: thread %lx: invalid conversion output from iconv\n", tidx); - pthread_exit ((void *) (long int) 1); - } + TEST_COMPARE_BLOB (utf8, bytes, CONV_INPUT, bytes); pthread_exit (NULL); } -- cgit v1.2.3