Re: [PATCH 1/2] printf: fix heap buffer overflow in printf_builtin

[Chet Ramey]

On 8/30/24 10:41 AM, Martin D Kealey wrote:

Hi Andrei

Ok, I see the problem.

This fault is triggered when the format string has '%(' but is missing the
closing ')' - so the entire remainder of the format string is tentatively
recorded as the time-format substring.

Yes.

This line:

    if (*++fmt != 'T')

should be changed to:

    if (n > 0 || *++fmt != 'T')

I prefer checking whether *fmt == ')', which is equivalent but clearer.

--
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    c...@case.edu    http://tiswww.cwru.edu/~chet/

OpenPGP_signature.asc
Description: OpenPGP digital signature