Be more careful with string array bounds! Found by LLVM+Clang scan-build.
This commit is contained in:
parent
5a70000aaf
commit
9d2fefeac4
9
shf.c
9
shf.c
|
@ -24,7 +24,7 @@
|
||||||
|
|
||||||
#include "sh.h"
|
#include "sh.h"
|
||||||
|
|
||||||
__RCSID("$MirOS: src/bin/mksh/shf.c,v 1.47 2012/10/03 16:16:15 tg Exp $");
|
__RCSID("$MirOS: src/bin/mksh/shf.c,v 1.48 2012/12/04 01:11:16 tg Exp $");
|
||||||
|
|
||||||
/* flags to shf_emptybuf() */
|
/* flags to shf_emptybuf() */
|
||||||
#define EB_READSW 0x01 /* about to switch to reading */
|
#define EB_READSW 0x01 /* about to switch to reading */
|
||||||
|
@ -971,14 +971,13 @@ shf_vfprintf(struct shf *shf, const char *fmt, va_list args)
|
||||||
|
|
||||||
case 'c':
|
case 'c':
|
||||||
flags &= ~FL_DOT;
|
flags &= ~FL_DOT;
|
||||||
numbuf[0] = (char)(VA(int));
|
c = (char)(VA(int));
|
||||||
s = numbuf;
|
/* FALLTHROUGH */
|
||||||
len = 1;
|
|
||||||
break;
|
|
||||||
|
|
||||||
case '%':
|
case '%':
|
||||||
default:
|
default:
|
||||||
numbuf[0] = c;
|
numbuf[0] = c;
|
||||||
|
numbuf[1] = 0;
|
||||||
s = numbuf;
|
s = numbuf;
|
||||||
len = 1;
|
len = 1;
|
||||||
break;
|
break;
|
||||||
|
|
5
var.c
5
var.c
|
@ -27,7 +27,7 @@
|
||||||
#include <sys/sysctl.h>
|
#include <sys/sysctl.h>
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
__RCSID("$MirOS: src/bin/mksh/var.c,v 1.162 2012/12/01 01:36:30 tg Exp $");
|
__RCSID("$MirOS: src/bin/mksh/var.c,v 1.163 2012/12/04 01:11:17 tg Exp $");
|
||||||
|
|
||||||
/*-
|
/*-
|
||||||
* Variables
|
* Variables
|
||||||
|
@ -615,10 +615,13 @@ formatstr(struct tbl *vp, const char *s)
|
||||||
--slen;
|
--slen;
|
||||||
}
|
}
|
||||||
if (vp->flag & ZEROFIL && vp->flag & INTEGER) {
|
if (vp->flag & ZEROFIL && vp->flag & INTEGER) {
|
||||||
|
if (!s[0] || !s[1])
|
||||||
|
goto uhm_no;
|
||||||
if (s[1] == '#')
|
if (s[1] == '#')
|
||||||
n = 2;
|
n = 2;
|
||||||
else if (s[2] == '#')
|
else if (s[2] == '#')
|
||||||
n = 3;
|
n = 3;
|
||||||
|
uhm_no:
|
||||||
if (vp->u2.field <= n)
|
if (vp->u2.field <= n)
|
||||||
n = 0;
|
n = 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue