From 5b90bc828521f637513fd4e3f2ba2a7607a46f71 Mon Sep 17 00:00:00 2001 From: Daniil Sarafannikov Date: Fri, 26 Jun 2026 00:04:09 +0400 Subject: [PATCH] roken:strsep_copy: Fix out-of-bounds write in strsep_copy In case len < (size_t)(*stringp - save) and len > 0 access to buf[l] leads to out-of-bounds write as l = len and len means the length of buffer. Change evaluation of l: only len - 1 elements of buffer can be used for memcpy and terminator should be written to buf[len - 1] (in case l = len - 1). Also, this value of l is not used when len == 0, so we calculate it only when len > 0. Pair-Programmed-With: Dmitry Mikhalchenko Signed-off-by: Daniil Sarafannikov --- lib/roken/strsep_copy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/roken/strsep_copy.c b/lib/roken/strsep_copy.c index 1228f1a45..00d6e22ff 100644 --- a/lib/roken/strsep_copy.c +++ b/lib/roken/strsep_copy.c @@ -49,8 +49,8 @@ strsep_copy(const char **stringp, const char *delim, char *buf, size_t len) if(save == NULL) return -1; *stringp = *stringp + strcspn(*stringp, delim); - l = min(len, (size_t)(*stringp - save)); if(len > 0) { + l = min(len - 1, (size_t)(*stringp - save)); memcpy(buf, save, l); buf[l] = '\0'; }