Skip to content
This repository has been archived by the owner on Apr 19, 2024. It is now read-only.

Commit

Permalink
Fix an out-of-bounds read in fgetline().
Browse files Browse the repository at this point in the history
Forgot that a zero-length string might have come back from fgets.

Thanks to Hanno Böck for spotting this, with the aid of AFL.
  • Loading branch information
sgtatham committed Nov 10, 2015
1 parent fa7b23c commit 5815d6a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion misc.c
Expand Up @@ -460,7 +460,7 @@ char *fgetline(FILE *fp)
int size = 512, len = 0;
while (fgets(ret + len, size - len, fp)) {
len += strlen(ret + len);
if (ret[len-1] == '\n')
if (len > 0 && ret[len-1] == '\n')
break; /* got a newline, we're done */
size = len + 512;
ret = sresize(ret, size, char);
Expand Down

0 comments on commit 5815d6a

Please sign in to comment.