From: Rocket Ma Date: Thu, 23 Apr 2026 16:09:23 +0000 (-0700) Subject: stdio-common: Fix overflow registering modifier [BZ #34086] X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4fd40bba95f666470b5e40ed6aca641f5e46d2e6;p=thirdparty%2Fglibc.git stdio-common: Fix overflow registering modifier [BZ #34086] * stdio-common/reg-modifier.c: The wchar in str can be greater or equal than 0, and less or equal than UCHAR_MAX, that means, we need a buffer with UCHAR_MAX + 1 elements, so that user input will not overflow __printf_modifier_table. Signed-off-by: Rocket Ma Reviewed-by: Adhemerval Zanella --- diff --git a/stdio-common/reg-modifier.c b/stdio-common/reg-modifier.c index 60d0521527..367f482bd5 100644 --- a/stdio-common/reg-modifier.c +++ b/stdio-common/reg-modifier.c @@ -66,7 +66,7 @@ __register_printf_modifier (const wchar_t *str) if (__printf_modifier_table == NULL) { - __printf_modifier_table = calloc (UCHAR_MAX, + __printf_modifier_table = calloc (UCHAR_MAX + 1, sizeof (*__printf_modifier_table)); if (__printf_modifier_table == NULL) goto out;