[PATCH 3/4] libc/iconv: find_alias was mis-computing remaining alias table length

Keith Packard keithp@keithp.com
Thu Jul 9 23:58:47 GMT 2020


This caused the strnstr to walk off the end of the alias array and
fetch invalid data. Instead of attempting to update 'len', just
re-compute it based on the table end pointer that is already known.

Signed-off-by: Keith Packard <keithp@keithp.com>
---
 newlib/libc/iconv/lib/aliasesi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/newlib/libc/iconv/lib/aliasesi.c b/newlib/libc/iconv/lib/aliasesi.c
index d04cebb57..ef5ce4109 100644
--- a/newlib/libc/iconv/lib/aliasesi.c
+++ b/newlib/libc/iconv/lib/aliasesi.c
@@ -115,7 +115,7 @@ search_again:
      && (p+l == table_end || isspace (*(p+l)) || *(p+l) == '\n')))
     {
       ptable = p + l;
-      len -= table - p;
+      len = table_end - ptable;
       goto search_again;
     }
 
-- 
2.27.0



More information about the Newlib mailing list