Re: [PATCH] fetch--tool: fix uninitialized buffer when reading from stdin

From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Feb 26, 2007, 16:24 UTC
Message-ID: <Pine.LNX.4.64.0702260821310.12485@woody.linux-foundation.org>
In-Reply-To: <Pine.LNX.4.63.0702261306140.22628@wbgn013.biozentrum.uni-wuerzburg.de>

On Mon, 26 Feb 2007, Johannes Schindelin wrote:

Show 20 quoted lines

> 
> Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
> ---
>  builtin-fetch--tool.c |    4 ++++
>  1 files changed, 4 insertions(+), 0 deletions(-)
> 
> diff --git a/builtin-fetch--tool.c b/builtin-fetch--tool.c
> index 48de08d..e5bb560 100644
> --- a/builtin-fetch--tool.c
> +++ b/builtin-fetch--tool.c
> @@ -14,6 +14,10 @@ static char *get_stdin(void)
>  		data = xrealloc(data, offset + CHUNK_SIZE);
>  		read = xread(0, data + offset, CHUNK_SIZE);
>  	}
> +	if (read > 0 && data[read - 1] == '\n')
> +		data[read - 1] = '\0';
> +	else
> +		data[read] = '\0';
>  	return data;
>  }

This is horrible crap.

First off, "read" here may be -1.

Secondly, "data[read]", even if read is positive, is in the *middle* of a buffer.

It should probably be something like

	if (read > 0)
		offset += read;

	/* Why do this? Because Dscho did.. */
	if (offset && data[offset-1] == '\n')
		offset--;

	data[offset] = 0;

which at least seems to be potentially sane.

		Linus