From 9c3856146a75ac038ffa8e2c089965bb91720236 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Thu, 25 Jun 2026 22:00:26 +0530 Subject: fix out-of-bounds write in getdelim on undersized buffer --- crypto/compat/getdelim.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c index caec3f2..2c5a8a0 100644 --- a/crypto/compat/getdelim.c +++ b/crypto/compat/getdelim.c @@ -38,10 +38,18 @@ getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) char *ptr, *eptr; - if (*buf == NULL || *bufsiz == 0) { - *bufsiz = BUFSIZ; - if ((*buf = malloc(*bufsiz)) == NULL) + /* + * Ensure the buffer can hold at least one byte plus the NUL + * terminator before the loop writes to it. A caller-supplied + * buffer smaller than that is grown rather than overrun. + */ + if (*buf == NULL || *bufsiz < 2) { + char *nbuf; + size_t nbufsiz = BUFSIZ; + if ((nbuf = realloc(*buf, nbufsiz)) == NULL) return -1; + *buf = nbuf; + *bufsiz = nbufsiz; } for (ptr = *buf, eptr = *buf + *bufsiz;;) { -- cgit v1.2.3-55-g6feb From 8c8af254aa0d8ed50a4d99fe8c60450819f2cbf3 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Fri, 26 Jun 2026 13:24:53 +0530 Subject: getdelim: drop comment, give nbuf/nbufsiz function scope --- crypto/compat/getdelim.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c index 2c5a8a0..9bacf0c 100644 --- a/crypto/compat/getdelim.c +++ b/crypto/compat/getdelim.c @@ -35,17 +35,12 @@ ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) { - char *ptr, *eptr; + char *ptr, *eptr, *nbuf; + size_t nbufsiz; - /* - * Ensure the buffer can hold at least one byte plus the NUL - * terminator before the loop writes to it. A caller-supplied - * buffer smaller than that is grown rather than overrun. - */ if (*buf == NULL || *bufsiz < 2) { - char *nbuf; - size_t nbufsiz = BUFSIZ; + nbufsiz = BUFSIZ; if ((nbuf = realloc(*buf, nbufsiz)) == NULL) return -1; *buf = nbuf; @@ -70,9 +65,8 @@ getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) return ptr - *buf; } if (ptr + 2 >= eptr) { - char *nbuf; - size_t nbufsiz = *bufsiz * 2; ssize_t d = ptr - *buf; + nbufsiz = *bufsiz * 2; if ((nbuf = realloc(*buf, nbufsiz)) == NULL) return -1; *buf = nbuf; -- cgit v1.2.3-55-g6feb