| Issue |
203649
|
| Summary |
[libc] Improve wcslcat and wcsncat implementation.
|
| Labels |
good first issue,
libc
|
| Assignees |
|
| Reporter |
vonosmas
|
Today the implementation of `wcslcat` https://github.com/llvm/llvm-project/blob/c9b25a6437fd97fdb1e55ab6661c0cccce98913e/libc/src/wchar/wcslcat.cpp#L22-L24 is problematic:
* it effectively calls unbounded wcslen on destination string (the length might be larger than `dstsize`)
* computing `dstsize-dstlen-1` in size_t type might also underflow (though subsequent cast to int would result in positive integer in extremely rare circumstances)
`wcsncat` implementation: https://github.com/llvm/llvm-project/blob/c9b25a6437fd97fdb1e55ab6661c0cccce98913e/libc/src/wchar/wcsncat.cpp#L23-L25
also has on OOB read of character at position `n` in `s2`.
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
