svn commit: r351041 - in stable: 11/lib/libc/string 12/lib/libc/string

[Dimitry Andric]

Author: dim
Date: Wed Aug 14 19:21:26 2019
New Revision: 351041
URL: https://svnweb.freebsd.org/changeset/base/351041

Log:
  MFC r350697:
  
  Fix a possible segfault in wcsxfrm(3) and wcsxfrm_l(3).
  
  If the length of the source wide character string, passed in via the
  "size_t n" parameter, is set to zero, the function should only return
  the required length for the destination wide character string.  In this
  case, it should *not* attempt to write to the destination, so the "dst"
  parameter is permitted to be NULL.
  
  However, when the internally called _collate_wxfrm() function returns an
  error, such as when using the "C" locale, as a fallback wcscpy(3) or
  wcsncpy(3) are used.  But if the input length is zero, wcsncpy(3) will
  be called with a length of -1!  If the "dst" parameter is NULL, this
  will immediately result in a segfault, or if "dst" is a valid pointer,
  it will most likely result in unexpectedly overwritten memory.
  
  Fix this by explicitly checking for an input length greater than zero,
  before calling wcsncpy(3).
  
  Note that a similar situation does not occur in strxfrm(3), the plain
  character version of this function, as it uses strlcpy(3) for the error
  case.  The strlcpy(3) function does not write to the destination if the
  input length is zero.

Modified:
  stable/11/lib/libc/string/wcsxfrm.c
Directory Properties:
  stable/11/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/12/lib/libc/string/wcsxfrm.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/11/lib/libc/string/wcsxfrm.c
==============================================================================
--- stable/11/lib/libc/string/wcsxfrm.c	Wed Aug 14 18:41:28 2019	(r351040)
+++ stable/11/lib/libc/string/wcsxfrm.c	Wed Aug 14 19:21:26 2019	(r351041)
@@ -71,7 +71,7 @@ error:
 	slen = wcslen(src);
 	if (slen < len)
 		(void) wcscpy(dest, src);
-	else {
+	else if (len > 0) {
 		(void) wcsncpy(dest, src, len - 1);
 		dest[len - 1] = L'\0';
 	}