提交 27593d3a 编写于 作者: R Rich Felker

fix theoretical out-of-bound access in dynamic linker

one of the arguments to memcmp may be shorter than the length l-3, and
memcmp is under no obligation not to access past the first byte that
differs. instead use strncmp which conveys the correct semantics. the
performance difference is negligible here and since the code is only
use for shared libc, both functions are already linked anyway.
上级 f8c376da
...@@ -467,7 +467,7 @@ static struct dso *load_library(const char *name) ...@@ -467,7 +467,7 @@ static struct dso *load_library(const char *name)
char *z = strchr(name, '.'); char *z = strchr(name, '.');
if (z) { if (z) {
size_t l = z-name; size_t l = z-name;
for (rp=reserved; *rp && memcmp(name+3, rp, l-3); rp+=strlen(rp)+1); for (rp=reserved; *rp && strncmp(name+3, rp, l-3); rp+=strlen(rp)+1);
if (*rp) { if (*rp) {
if (ldd_mode) { if (ldd_mode) {
/* Track which names have been resolved /* Track which names have been resolved
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册