Fix out-of-bounds write on errors in lambdas

When a runtime error in a lambda occurs, the buffer for the lambda name was two bytes too small. (Fixes #886)
amotzkau · Mar 30, 2021 · f2238d7 · f2238d7
1 parent 1cb48b8
commit f2238d7
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
@@ -26,7 +26,7 @@ jobs:
                                --enable-malloc-trace --enable-malloc-lpc-trace  --enable-dynamic-costs
                                --enable-eval-cost-trace --enable-trace-code
                                ${{ matrix.coverage && '--with-optimize=no' || ''}}
-                               EXTRA_CFLAGS="-DINSIDE_TRAVIS -Werror ${{ matrix.cc == 'gcc' && '-Wno-unused-result' || '' }}"
+                               EXTRA_CFLAGS="-DINSIDE_TRAVIS -Werror ${{ matrix.cc == 'gcc' && '-Wno-unused-result' || '' }} ${{ matrix.cc == 'gcc' && !matrix.coverage && '-D_FORTIFY_SOURCE=2' || '' }}"
                                CC=${{ matrix.cc }}
             - name: Build driver
               working-directory: src

diff --git a/src/interpret.c b/src/interpret.c
@@ -19004,7 +19004,7 @@ get_line_number_if_any (string_t **name)
             string_t * location, *tmp;
             lambda_t * l;
 
-            sprintf(name_buffer, "<lambda 0x%6p>", csp->funstart);
+            sprintf(name_buffer, "<lambda %6p>", csp->funstart);
             memsafe(*name = new_mstring(name_buffer, STRING_ASCII), strlen(name_buffer)
                    , "lambda name");
             /* Find the beginning of the lambda structure.*/