Possible bug in make
Max Okumoto
okumoto at home
Sun Nov 14 01:50:30 PST 2004
In function Arch_ParseArchive() line 349, there is a possible buffer
over run. I don't have a test case, but the grow buffer code
has an inverted test.
Lst members = Lst_Init(FALSE);
char *member;
size_t sz = MAXPATHLEN;
size_t nsz;
nameBuf = emalloc(sz);
Dir_Expand(memName, dirSearchPath, members);
while (!Lst_IsEmpty(members)) {
member = (char *)Lst_DeQueue(members);
nsz = strlen(libName) + strlen(member) + 3;
if (sz > nsz)
nameBuf = erealloc(nameBuf, sz = nsz * 2);
^^^^^^^^^^^^^
Test is backwards. nameBuf should be reallocated if (sz < nsz).
snprintf(nameBuf, sz, "%s(%s)", libName, member);
free(member);
gn = Targ_FindNode (nameBuf, TARG_CREATE);
if (gn == NULL) {
free(nameBuf);
More information about the Bugs
mailing list