fix out-of-bounds write in getdelim on undersized buffer

1 files changed, 11 insertions, 3 deletions

diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c
index caec3f2..2c5a8a0 100644
--- a/crypto/compat/getdelim.c
+++ b/crypto/compat/getdelim.c
@@ -38,10 +38,18 @@ getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
         char *ptr, *eptr;
 
 
-        if (*buf == NULL || *bufsiz == 0) {
-                *bufsiz = BUFSIZ;
-                if ((*buf = malloc(*bufsiz)) == NULL)
+        /*
+         * Ensure the buffer can hold at least one byte plus the NUL
+         * terminator before the loop writes to it.  A caller-supplied
+         * buffer smaller than that is grown rather than overrun.
+         */
+        if (*buf == NULL || *bufsiz < 2) {
+                char *nbuf;
+                size_t nbufsiz = BUFSIZ;
+                if ((nbuf = realloc(*buf, nbufsiz)) == NULL)
                         return -1;
+                *buf = nbuf;
+                *bufsiz = nbufsiz;
         }
 
         for (ptr = *buf, eptr = *buf + *bufsiz;;) {