On 10/4/21 4:44 PM, Andreas Schwab wrote:
On Okt 04 2021, Chet Ramey wrote:
I suspect this is a buffer overflow introduced between systemd-247 and
systemd-249. It's not caught when building bash without the bash malloc
because the default libc malloc probably doesn't do the bounds checking
the bash malloc does, even without malloc debugging turned on.
If it's a buffer overflow, then valgrind should be able to catch it
(when bash is configured --without-bash-malloc). valgrind's bounds
checking is much more advanced than what a checking malloc can do.
You'd think. This is the kind of overflow that will produce that error
message from the bash malloc:
int
main(int c, char **v)
{
char *buf;
buf = (char *)malloc (40);
if (buf == 0) {
fprintf(stderr, "malloc failed\n");
exit(1);
}
buf[40]='\254';
buf = realloc(buf, 218);
buf[218]='\214';
free(buf);
exit(0);
}
--
``The lyf so short, the craft so long to lerne.'' - Chaucer
``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU c...@case.edu http://tiswww.cwru.edu/~chet/
