From: Thomas Vincent <thomasvincent@gmail.com>
Date: Thu, 16 Jul 2026 07:25:33 +0000 (-0700)
Subject: hardening: size the rrd_diff scratch buffer for its largest input
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=84e30cb8cd6d0fbc20f4c2e7d430ac323fbcd834;p=thirdparty%2Frrdtool-1.x.git

hardening: size the rrd_diff scratch buffer for its largest input

rrd_diff() accepts operand strings up to LAST_DS_LEN digits (m <=
LAST_DS_LEN), but writes the space fill through res[m+1] and the
trailing NUL at res[m+2], while res was only LAST_DS_LEN + 1 bytes.
A max-length operand therefore ran two bytes past the buffer. Give res
the LAST_DS_LEN + 3 bytes it actually uses. Confirmed with ASan before
and after.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---

diff --git a/src/rrd_diff.c b/src/rrd_diff.c
index 0e212f25..56d1752d 100644
--- a/src/rrd_diff.c
+++ b/src/rrd_diff.c
@@ -14,7 +14,11 @@ double rrd_diff(
     char *a,
     char *b)
 {
-    char      res[LAST_DS_LEN + 1], *a1, *b1, *r1, *fix;
+    /* res is filled up to res[m+2] (the space fill writes res[m+1] and the
+     * trailing NUL lands on res[m+2]) while m is only bounded to <=
+     * LAST_DS_LEN below, so the scratch buffer needs LAST_DS_LEN + 3 bytes,
+     * not + 1. */
+    char      res[LAST_DS_LEN + 3], *a1, *b1, *r1, *fix;
     int       c, x, m;
     char      a_neg = 0, b_neg = 0;
     double    result;