lzbench icon indicating copy to clipboard operation
lzbench copied to clipboard

Fix segfault for bad write in lzbench.cpp

Open richarddd opened this issue 1 year ago • 1 comments

Fix segfault for writing beyond the size of cpu_brand_str

richarddd avatar May 30 '23 04:05 richarddd

I'm surprised as it was my PR. In line 753 there is a string allocated that is 1 character longer than cpu string, to fit null-terminator.

char* cpu_brand_str = (char*)calloc(1, 3*sizeof(mx)+1);

But as you noticed, index of last element is 3*sizeof(mx) and string's length is 3*sizeof(mx)+1.

How did you find it, add brand strings are, generally, shorter and won't go this far to cause overflow?

tansy avatar Oct 10 '23 09:10 tansy