Project

General

Profile

Download (1.32 KB)

Submit #2920 » eilseq_fix_corrected_2.patch

Fix possible NULL pointer dereference and EILSEQ behavior - yellowrabbit2010, 06/09/2016 03:00 AM

View differences:

lib/libc/locale/ascii.c
size_t nchr;
if (dst == NULL) {
s = memchr(*src, '\0', nms);
if (*s & 0x80) {
errno = EILSEQ;
return ((size_t)-1);
s = *src;
while (*s != '\0' && nms-- > 0) {
if (*s & 0x80) {
errno = EILSEQ;
return ((size_t)-1);
}
++s;
}
return (s != NULL ? s - *src : nms);
return (s - *src);
}
s = *src;
nchr = 0;
while (len-- > 0 && nms-- > 0) {
if (*s & 0x80) {
*src = s;
errno = EILSEQ;
return ((size_t)-1);
}
......
nchr = 0;
while (len-- > 0 && nwc-- > 0) {
if (*s < 0 || *s > 127) {
*src = s;
errno = EILSEQ;
return ((size_t)-1);
}
lib/libc/locale/none.c
nchr = 0;
while (len-- > 0 && nwc-- > 0) {
if (*s < 0 || *s > UCHAR_MAX) {
*src = s;
errno = EILSEQ;
return ((size_t)-1);
}
(3-3/3)