[commit: ghc] master: ProfilerReportJson.c: fix out-of-bounds access (20c39b7)

git at git.haskell.org git at git.haskell.org
Sun May 14 19:34:45 UTC 2017


Repository : ssh://git@git.haskell.org/ghc

On branch  : master
Link       : http://ghc.haskell.org/trac/ghc/changeset/20c39b7743a242fce785e5c6507a8549dba7a8d2/ghc

>---------------------------------------------------------------

commit 20c39b7743a242fce785e5c6507a8549dba7a8d2
Author: Sergei Trofimovich <slyfox at gentoo.org>
Date:   Sun May 14 20:21:50 2017 +0100

    ProfilerReportJson.c: fix out-of-bounds access
    
    Found by gcc-7.1 which reported build error as:
    
    rts/ProfilerReportJson.c:23:16: error:
         error: comparison between pointer and zero
           character constant [-Werror=pointer-compare]
             for (; str != '\0' && len > 0; str++) {
                        ^~
       |
    23 |     for (; str != '\0' && len > 0; str++) {
       |                ^
    
    Unfixed code in context:
    
    ```c
      static void escapeString(char const* str, char *out, int len)
      {
         len--; // reserve character in output for terminating NUL
         for (; str != '\0' && len > 0; str++) {
             char c = *str;
    ```
    
    The intent here is to process 'len' (if positive) or '\0'-terminator
    in 'str' but dereference was missing.
    
    Signed-off-by: Sergei Trofimovich <slyfox at gentoo.org>


>---------------------------------------------------------------

20c39b7743a242fce785e5c6507a8549dba7a8d2
 rts/ProfilerReportJson.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rts/ProfilerReportJson.c b/rts/ProfilerReportJson.c
index 3cf875e..a786921 100644
--- a/rts/ProfilerReportJson.c
+++ b/rts/ProfilerReportJson.c
@@ -20,7 +20,7 @@
 static void escapeString(char const* str, char *out, int len)
 {
     len--; // reserve character in output for terminating NUL
-    for (; str != '\0' && len > 0; str++) {
+    for (; *str != '\0' && len > 0; str++) {
         char c = *str;
         if (c == '\\') {
             if (len < 2) break;



More information about the ghc-commits mailing list