[3/4] libc/iconv: find_alias was mis-computing remaining alias table length

Message ID 20200709235848.3496713-3-keithp@keithp.com
State Accepted
Commit 24f3c6195395b8836f51fbfaeca35062c60bb056
Headers show
Series
  • [1/4] libc/iconv: Detect CES handler loading failure
Related show

Commit Message

Keith Packard via Newlib July 9, 2020, 11:58 p.m.
This caused the strnstr to walk off the end of the alias array and
fetch invalid data. Instead of attempting to update 'len', just
re-compute it based on the table end pointer that is already known.

Signed-off-by: Keith Packard <keithp@keithp.com>

---
 newlib/libc/iconv/lib/aliasesi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.27.0

Patch

diff --git a/newlib/libc/iconv/lib/aliasesi.c b/newlib/libc/iconv/lib/aliasesi.c
index d04cebb57..ef5ce4109 100644
--- a/newlib/libc/iconv/lib/aliasesi.c
+++ b/newlib/libc/iconv/lib/aliasesi.c
@@ -115,7 +115,7 @@  search_again:
      && (p+l == table_end || isspace (*(p+l)) || *(p+l) == '\n')))
     {
       ptable = p + l;
-      len -= table - p;
+      len = table_end - ptable;
       goto search_again;
     }