aboutsummaryrefslogtreecommitdiff
path: root/fuzzpuzz.c
diff options
context:
space:
mode:
authorBen Harris <bjh21@bjh21.me.uk>2023-01-16 10:43:41 +0000
committerBen Harris <bjh21@bjh21.me.uk>2023-01-16 10:43:41 +0000
commit4b5422181deb3b09a7926aa51a7b26d656ca15ba (patch)
treec702e884aaceee1457b1bddf91baac26dd7a1b91 /fuzzpuzz.c
parentf5924fc8a70fede4dda4eddb35229fc70cb5b38a (diff)
downloadpuzzles-4b5422181deb3b09a7926aa51a7b26d656ca15ba.zip
puzzles-4b5422181deb3b09a7926aa51a7b26d656ca15ba.tar.gz
puzzles-4b5422181deb3b09a7926aa51a7b26d656ca15ba.tar.bz2
puzzles-4b5422181deb3b09a7926aa51a7b26d656ca15ba.tar.xz
Fix use-after-free in fuzzpuzz
When reporting that the game name in a save file isn't recognised, don't include the name from the save file in the error message, partly to avoid the complexity of freeing it properly on two different code paths and partly because including unsanitized data from a fuzzer-supplied save file in the error message just seems dangerous. And properly sanitising it would waste the fuzzer's time exploring the sanitising code. Thanks to Ben Hutchings for reporting the bug.
Diffstat (limited to 'fuzzpuzz.c')
-rw-r--r--fuzzpuzz.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fuzzpuzz.c b/fuzzpuzz.c
index 2b6037c..6e1dc65 100644
--- a/fuzzpuzz.c
+++ b/fuzzpuzz.c
@@ -81,7 +81,7 @@ int main(int argc, char **argv)
ourgame = gamelist[i];
sfree(gamename);
if (ourgame == NULL) {
- fprintf(stderr, "Game '%s' not recognised\n", gamename);
+ fprintf(stderr, "Game not recognised\n");
ret = 1;
continue;
}