diff options
| author | Simon Tatham <anakin@pobox.com> | 2017-05-14 08:08:57 +0100 |
|---|---|---|
| committer | Simon Tatham <anakin@pobox.com> | 2017-05-14 08:49:07 +0100 |
| commit | 41ef29132b50404f6157d83d1edf9a133e422c9f (patch) | |
| tree | 84d154ec15bd5f03eb83a520940aa7e83c866894 /misc/logalloc | |
| parent | 90b5c251fd86c444f54184d0d30e3d6462cbb7ae (diff) | |
| download | halibut-41ef29132b50404f6157d83d1edf9a133e422c9f.zip halibut-41ef29132b50404f6157d83d1edf9a133e422c9f.tar.gz halibut-41ef29132b50404f6157d83d1edf9a133e422c9f.tar.bz2 halibut-41ef29132b50404f6157d83d1edf9a133e422c9f.tar.xz | |
Fix two potential buffer under/overruns.
The one in wcwidth.c actually came up in one of my valgrind runs: if
you passed it a non-null-terminated wide string (specifically, one
that reaches invalid memory exactly when the length parameter runs
out), it would illegally load the character beyond the end of the
string before noticing that the length parameter said it shouldn't.
The one in bk_man.c may well not be able to come up at all, but I
spotted it in passing and I thought I might as well fix it - it makes
me twitch on general principles to see any use of buf[len-1] without
having checked len>0 first.
Diffstat (limited to 'misc/logalloc')
0 files changed, 0 insertions, 0 deletions