9fans / plan9port

Plan 9 from User Space
https://9fans.github.io/plan9port/
Other
1.64k stars 326 forks source link

`cleanname` has a 1-char OOB write when input is `""` #686

Open noncombatant opened 4 weeks ago

noncombatant commented 4 weeks ago

It's at line 50: https://github.com/9fans/plan9port/blob/61e362add9e1485bec1ab8261d729016850ec270/src/lib9/cleanname.c#L50. There isn't necessarily a second byte to write into. Detected with ASAN.

Unfortunately, I think this means the API has to change (to explicitly ignore or reject blank strings): blank strings can't be cleaned to ".".