[master] f77b11c82 vtc_process: Prevent -expect-text overflows

Dridi Boukelmoune dridi.boukelmoune at gmail.com
Mon Feb 7 17:35:05 UTC 2022


commit f77b11c82f74f3697dd78073a49ab4a18e1e916d
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Feb 7 18:25:47 2022 +0100

    vtc_process: Prevent -expect-text overflows

diff --git a/bin/varnishtest/vtc_process.c b/bin/varnishtest/vtc_process.c
index d9d5ddaad..1fbcc4650 100644
--- a/bin/varnishtest/vtc_process.c
+++ b/bin/varnishtest/vtc_process.c
@@ -259,6 +259,7 @@ static int
 term_find_textline(const struct process *pp, int *x, int y, const char *pat)
 {
 	const char *t;
+	int l;
 
 	if (*x == 0) {
 		t = strstr(pp->vram[y], pat);
@@ -268,7 +269,9 @@ term_find_textline(const struct process *pp, int *x, int y, const char *pat)
 		}
 	} else if (*x <= pp->ncol) {
 		t = pp->vram[y] + *x - 1;
-		if (!memcmp(t, pat, strlen(pat)))
+		l = strlen(pat);
+		assert((*x - 1) + (l - 1) < pp->ncol);
+		if (!memcmp(t, pat, l))
 			return (1);
 	}
 	return (0);
@@ -309,6 +312,8 @@ term_expect_text(struct process *pp,
 	if (x < 0 || x > pp->ncol)
 		vtc_fatal(pp->vl, "XXX %d ncol %d", x, pp->ncol);
 	l = strlen(pat);
+	if (x + l - 1 > pp->ncol)
+		vtc_fatal(pp->vl, "XXX %d ncol %d", x + l - 1, pp->ncol);
 	AZ(pthread_mutex_lock(&pp->mtx));
 	while (!term_find_text(pp, &x, &y, pat)) {
 		if (x != 0 && y != 0) {


More information about the varnish-commit mailing list