diff options
author | Julian Andres Klode <jak@debian.org> | 2016-08-31 17:01:04 +0200 |
---|---|---|
committer | Julian Andres Klode <jak@debian.org> | 2016-08-31 17:39:06 +0200 |
commit | 923c592ceb6014b31ec751b97b3ed659fa3e88ae (patch) | |
tree | 844f89090a5e427ced68312c6dcf5004ee11979d /apt-pkg/clean.cc | |
parent | 832f95f4d018f18ff7b3d0381206f25b5a4373a6 (diff) |
TagFile: Fix off-by-one errors in comment stripping
Adding 1 to the value of d->End - current makes restLength one byte
too long: If we pass memchr(current, ..., restLength) has thus
undefined behavior.
Also, reading the value of current has undefined behavior if
current >= d->End, not only for current > d->End:
Consider a string of length 1, that is d->End = d->Current + 1.
We can only read at d->Current + 0, but d->Current + 1 is beyond
the end of the string.
This probably caused several inexplicable build failures on hurd-i386
in the past, and just now caused a build failure on Ubuntu's amd64
builder.
Reported-By: valgrind
Diffstat (limited to 'apt-pkg/clean.cc')
0 files changed, 0 insertions, 0 deletions