Skip to content

Commit fc96c70

Browse files
committed
Fixed heap buffer overflow in files edit_line
``` ==25903==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50200004460f at pc 0x7fa23c10ec86 bp 0x7ffef7339c60 sp 0x7ffef7339408 READ of size 1 at 0x50200004460f thread T0 #0 0x7fa23c10ec85 in __interceptor_strncmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:497 #1 0x7fa23be8d09b in StringSafeCompareN /tmp/matchpolicy_poc_3369/cfengine-core/libntech/libutils/string_lib.c:254 #2 0x7fa23be8d10f in StringEqualN /tmp/matchpolicy_poc_3369/cfengine-core/libntech/libutils/string_lib.c:268 #3 0x560644d90e30 in MatchPolicy /tmp/matchpolicy_poc_3369/cfengine-core/cf-agent/files_editline.c:1749 ---snip--- 0x50200004460f is located 1 bytes to the left of 4-byte region [0x502000044610,0x502000044614) allocated by thread T0 here: ---snip--- ``` Ticket: ENT-13590 Changelog: Title Signed-off-by: Lars Erik Wik <lars.erik.wik@northern.tech> (cherry picked from commit 3da06b4)
1 parent d07b0b9 commit fc96c70

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

cf-agent/files_editline.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1746,7 +1746,7 @@ static bool MatchPolicy(EvalContext *ctx, const char *camel, const char *haystac
17461746
}
17471747
else if (opt == INSERT_MATCH_TYPE_IGNORE_TRAILING)
17481748
{
1749-
if (!StringEqualN(final + final_size - 5, "\\s*", 3))
1749+
if (final_size >= 5 && !StringEqualN(final + final_size - 5, "\\s*", 3))
17501750
{
17511751
const size_t work_size = final_size + 3;
17521752
char *work = xcalloc(1, work_size);

0 commit comments

Comments
 (0)