From 2e2e484ec4991ae53dfe018edc48fdfedaf31ec2 Mon Sep 17 00:00:00 2001
From: tim <>
Date: Tue, 23 Jun 2026 13:09:11 +0000
Subject: Avoid shift overflow in memmem(3) and strstr(3)

Fix from upstream musl:
https://git.musl-libc.org/cgit/musl/commit?id=593caa456309714402ca4cb77c3770f4c24da9da

OK tb@
---
 src/lib/libc/string/memmem.c | 10 +++++-----
 src/lib/libc/string/strstr.c | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libc/string/memmem.c b/src/lib/libc/string/memmem.c
index 3b180b4a62..e87c7be37a 100644
--- a/src/lib/libc/string/memmem.c
+++ b/src/lib/libc/string/memmem.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: memmem.c,v 1.5 2020/04/16 12:39:28 claudio Exp $ */
+/*	$OpenBSD: memmem.c,v 1.6 2026/06/23 13:09:11 tim Exp $ */
 
 /*
  * Copyright (c) 2005-2020 Rich Felker, et al.
@@ -38,8 +38,8 @@ twobyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 static char *
 threebyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
-	uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8;
-	uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8;
+	uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8;
+	uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8;
 	for (h+=3, k-=3; k; k--, hw = (hw|*h++)<<8)
 		if (hw == nw) return (char *)h-3;
 	return hw == nw ? (char *)h-3 : 0;
@@ -48,8 +48,8 @@ threebyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 static char *
 fourbyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
-	uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
-	uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
+	uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
+	uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
 	for (h+=4, k-=4; k; k--, hw = hw<<8 | *h++)
 		if (hw == nw) return (char *)h-4;
 	return hw == nw ? (char *)h-4 : 0;
diff --git a/src/lib/libc/string/strstr.c b/src/lib/libc/string/strstr.c
index 241a080e7a..06795d9838 100644
--- a/src/lib/libc/string/strstr.c
+++ b/src/lib/libc/string/strstr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: strstr.c,v 1.9 2020/04/16 12:37:52 claudio Exp $ */
+/*	$OpenBSD: strstr.c,v 1.10 2026/06/23 13:09:11 tim Exp $ */
 
 /*
  * Copyright (c) 2005-2018 Rich Felker
@@ -37,8 +37,8 @@ twobyte_strstr(const unsigned char *h, const unsigned char *n)
 static char *
 threebyte_strstr(const unsigned char *h, const unsigned char *n)
 {
-	uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8;
-	uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8;
+	uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8;
+	uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8;
 	for (h+=2; *h && hw != nw; hw = (hw|*++h)<<8);
 	return *h ? (char *)h-2 : 0;
 }
@@ -46,8 +46,8 @@ threebyte_strstr(const unsigned char *h, const unsigned char *n)
 static char *
 fourbyte_strstr(const unsigned char *h, const unsigned char *n)
 {
-	uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
-	uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
+	uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
+	uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
 	for (h+=3; *h && hw != nw; hw = hw<<8 | *++h);
 	return *h ? (char *)h-3 : 0;
 }
-- 
cgit v1.2.3-55-g6feb