Fossil SCM

Fix a problem introduced with [593ceca27d]: the blob resize operation may realloc the buffer, so obtain the pointer to the buffer only after the resize to avoid a "use after free".

florian 2024-12-18 18:30 trunk
Commit 36bcaaeee06e23aced66d2a94c4d237d4898f5b9ec8b6d7d1db4f7297179ec5a
1 file changed +1 -1
+1 -1
--- src/printf.c
+++ src/printf.c
@@ -850,12 +850,12 @@
850850
}
851851
case etHEX: {
852852
char *zArg = va_arg(ap, char*);
853853
int szArg = (int)strlen(zArg);
854854
int szBlob = blob_size(pBlob);
855
- u8 *aBuf = (u8*)&blob_buffer(pBlob)[szBlob];
856855
blob_resize(pBlob, szBlob+szArg*2+1);
856
+ u8 *aBuf = (u8*)&blob_buffer(pBlob)[szBlob];
857857
encode16((const u8*)zArg, aBuf, szArg);
858858
length = width = 0;
859859
break;
860860
}
861861
case etERROR:
862862
--- src/printf.c
+++ src/printf.c
@@ -850,12 +850,12 @@
850 }
851 case etHEX: {
852 char *zArg = va_arg(ap, char*);
853 int szArg = (int)strlen(zArg);
854 int szBlob = blob_size(pBlob);
855 u8 *aBuf = (u8*)&blob_buffer(pBlob)[szBlob];
856 blob_resize(pBlob, szBlob+szArg*2+1);
 
857 encode16((const u8*)zArg, aBuf, szArg);
858 length = width = 0;
859 break;
860 }
861 case etERROR:
862
--- src/printf.c
+++ src/printf.c
@@ -850,12 +850,12 @@
850 }
851 case etHEX: {
852 char *zArg = va_arg(ap, char*);
853 int szArg = (int)strlen(zArg);
854 int szBlob = blob_size(pBlob);
 
855 blob_resize(pBlob, szBlob+szArg*2+1);
856 u8 *aBuf = (u8*)&blob_buffer(pBlob)[szBlob];
857 encode16((const u8*)zArg, aBuf, szArg);
858 length = width = 0;
859 break;
860 }
861 case etERROR:
862

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button