more: fix out-of-bounds write in get_line() on invalid multibyte input

In get_line(), the invalid-multibyte switch arm (case (size_t)-1) writes
*p++ = mbc[0] without the bounds check that its sibling write paths use,
and the "goto process_mbc" back-edge lets it re-run within one loop
iteration, bypassing the loop-head guard. A line that first fills line_buf
with zero-width combining characters (which advance p but not column) and
then supplies an invalid multibyte sequence can step p past the
num_columns*4 + 2 byte allocation -- a heap out-of-bounds write.

Guard the write the same way the sibling path does.

Closes #4494

Signed-off-by: logical-misha <220645577+logical-misha@users.noreply.github.com>

diff --git a/text-utils/more.c b/text-utils/more.c
index 9cea37356c0071a6440df87f223f28c82f66a253..6f7140e714e54a30cf8f4a2dd66a45c4993b2de4 100644 (file)
--- a/text-utils/more.c
+++ b/text-utils/more.c
@@ -551,6 +551,8 @@ static int get_line(struct more_control *ctl, int *length)
                                break;
 
                        case (size_t)-1:        /* Invalid as a multibyte character. */
+                               if (p >= &ctl->line_buf[ctl->line_sz - 1])
+                                       break;
                                *p++ = mbc[0];
                                state = state_bak;
                                column++;