Skip to content

Commit bd1acd5

Browse files
committed
Fix memory corruption in mkstr caused by integer overflow
The static 'slot' variable in mkstr() was previously a signed 32-bit integer. On high-load systems (e.g., during status data dumps), this counter could overflow, becoming negative. In C, a negative dividend with the modulo operator (slot % 256) results in a negative index. This caused the 'ret' pointer to point to memory addresses BEFORE the actual buffer. In our case, this led to a SIGSEGV because a timestamp string was written directly over the 'contact_list' pointer, which happened to be located in that memory region. Changes: - Changed 'slot' from signed int to unsigned int (uint) to ensure the modulo result is always positive and within buffer bounds. - This ensures that upon reaching UINT_MAX, the counter wraps safely back to zero. Signed-off-by: nook24 <d.ziegler@avendis.com>
1 parent 35489d1 commit bd1acd5

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

lib/nsutils.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ int str2timeval(char *str, struct timeval *tv)
8989
const char *mkstr(const char *fmt, ...)
9090
{
9191
static char buf[MKSTR_BUFS][32]; /* 8k statically on the stack */
92-
static int slot = 0;
92+
static unsigned slot = 0;
9393
char *ret;
9494

9595
va_list ap;

0 commit comments

Comments
 (0)