]> Savannah Git Hosting - gnulib.git/commitdiff
human: fix output buffer overrun by 1
authorPaul Eggert <eggert@cs.ucla.edu>
Thu, 31 Dec 2015 21:16:55 +0000 (13:16 -0800)
committerPaul Eggert <eggert@cs.ucla.edu>
Thu, 31 Dec 2015 21:17:37 +0000 (13:17 -0800)
* lib/human.c (human_readable): Fix off-by-one typo in buffer
calculation that could lead to a one-byte buffer overrun.

ChangeLog
lib/human.c

index da7e48d6d0e7166d099318846acfcc1a37740bf5..8a919bad039530e5fecfd4853610bbcd9d53379f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2015-12-31  Paul Eggert  <eggert@cs.ucla.edu>
+
+       human: fix output buffer overrun by 1
+       * lib/human.c (human_readable): Fix off-by-one typo in buffer
+       calculation that could lead to a one-byte buffer overrun.
+
 2015-12-28  Daiki Ueno  <ueno@gnu.org>
 
        maint: fix operator precedence in mbrtowc test
index 7863f9c7d8d879481630d839769aa371d9831f51..767aaec76054aae3d4afa5f0f7361f5ddfdf16d2 100644 (file)
@@ -185,7 +185,8 @@ human_readable (uintmax_t n, char *buf, int opts,
   if (strlen (l->thousands_sep) <= MB_LEN_MAX)
     thousands_sep = l->thousands_sep;
 
-  psuffix = buf + LONGEST_HUMAN_READABLE - HUMAN_READABLE_SUFFIX_LENGTH_MAX;
+  /* Leave room for a trailing space and following suffix.  */
+  psuffix = buf + LONGEST_HUMAN_READABLE - 1 - HUMAN_READABLE_SUFFIX_LENGTH_MAX;
   p = psuffix;
 
   /* Adjust AMT out of FROM_BLOCK_SIZE units and into TO_BLOCK_SIZE