Skip to content

Commit 28a06e9

Browse files
committed
Fix out of bounds read in printf
When printf is given the format '%*' it would overflow and print environment variables. This fixes issue #574.
1 parent 8f19648 commit 28a06e9

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

toys/posix/printf.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ void printf_main(void)
9797

9898
// Parse width.precision between % and type indicator.
9999
*to++ = '%';
100-
while (strchr("-+# '0", *f) && (to-toybuf)<10) *to++ = *f++;
100+
while (stridx("-+# '0", *f) != -1 && (to-toybuf)<10) *to++ = *f++;
101101
for (;;) {
102102
if (chrstart(&f, '*')) {
103103
if (*arg) wp[i] = atolx(*arg++);
@@ -118,15 +118,15 @@ void printf_main(void)
118118
continue;
119119
} else if (c == 'c') printf(toybuf, wp[0], wp[1], *aa);
120120
else if (c == 's') printf(toybuf, wp[0], wp[1], aa);
121-
else if (strchr("diouxX", c)) {
121+
else if (stridx("diouxX", c) != -1) {
122122
long long ll;
123123

124124
if (*aa == '\'' || *aa == '"') ll = aa[1];
125125
else ll = strtoll(aa, &end, 0);
126126

127127
sprintf(to, "*.*ll%c", c);
128128
printf(toybuf, wp[0], wp[1], ll);
129-
} else if (strchr("feEgG", c)) {
129+
} else if (stridx("feEgG", c) != -1) {
130130
long double ld = strtold(aa, &end);
131131

132132
sprintf(to, "*.*L%c", c);

0 commit comments

Comments
 (0)