hardening: size the rrd_diff scratch buffer for its largest input

rrd_diff() accepts operand strings up to LAST_DS_LEN digits (m <=
LAST_DS_LEN), but writes the space fill through res[m+1] and the
trailing NUL at res[m+2], while res was only LAST_DS_LEN + 1 bytes.
A max-length operand therefore ran two bytes past the buffer. Give res
the LAST_DS_LEN + 3 bytes it actually uses. Confirmed with ASan before
and after.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

diff --git a/src/rrd_diff.c b/src/rrd_diff.c
index 0e212f25decc4a8fe4572362bdfa348f94d576e4..56d1752dd6380ffb049048e2508c17025ff18d3b 100644 (file)
--- a/src/rrd_diff.c
+++ b/src/rrd_diff.c
@@ -14,7 +14,11 @@ double rrd_diff(
     char *a,
     char *b)
 {
-    char      res[LAST_DS_LEN + 1], *a1, *b1, *r1, *fix;
+    /* res is filled up to res[m+2] (the space fill writes res[m+1] and the
+     * trailing NUL lands on res[m+2]) while m is only bounded to <=
+     * LAST_DS_LEN below, so the scratch buffer needs LAST_DS_LEN + 3 bytes,
+     * not + 1. */
+    char      res[LAST_DS_LEN + 3], *a1, *b1, *r1, *fix;
     int       c, x, m;
     char      a_neg = 0, b_neg = 0;
     double    result;