Fossil

Check-in [36bcaaeee0]
Login

Check-in [36bcaaeee0]

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Fix a problem introduced with [593ceca27d]: the blob resize operation may realloc the buffer, so obtain the pointer to the buffer only after the resize to avoid a "use after free".
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 36bcaaeee06e23aced66d2a94c4d237d4898f5b9ec8b6d7d1db4f7297179ec5a
User & Date: florian 2024-12-18 18:30:00
Context
2024-12-18
18:40
Fix the previous commit to restore ANSI C-89 conformance. ... (check-in: bee9b30168 user: florian tags: trunk)
18:30
Fix a problem introduced with [593ceca27d]: the blob resize operation may realloc the buffer, so obtain the pointer to the buffer only after the resize to avoid a "use after free". ... (check-in: 36bcaaeee0 user: florian tags: trunk)
12:51
Fix additional harmless memory leaks. ... (check-in: d564056cce user: drh tags: trunk)
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Changes to src/printf.c.

848
849
850
851
852
853
854
855
856

857
858
859
860
861
862
863
        length = width = 0;
        break;
      }
      case etHEX: {
        char *zArg = va_arg(ap, char*);
        int szArg = (int)strlen(zArg);
        int szBlob = blob_size(pBlob);
        u8 *aBuf = (u8*)&blob_buffer(pBlob)[szBlob];
        blob_resize(pBlob, szBlob+szArg*2+1);

        encode16((const u8*)zArg, aBuf, szArg);
        length = width = 0;
        break;
      }
      case etERROR:
        buf[0] = '%';
        buf[1] = c;







<

>







848
849
850
851
852
853
854

855
856
857
858
859
860
861
862
863
        length = width = 0;
        break;
      }
      case etHEX: {
        char *zArg = va_arg(ap, char*);
        int szArg = (int)strlen(zArg);
        int szBlob = blob_size(pBlob);

        blob_resize(pBlob, szBlob+szArg*2+1);
        u8 *aBuf = (u8*)&blob_buffer(pBlob)[szBlob];
        encode16((const u8*)zArg, aBuf, szArg);
        length = width = 0;
        break;
      }
      case etERROR:
        buf[0] = '%';
        buf[1] = c;