From: Weili Qian <qianweili@huawei.com> wd_parse_log_level in wd.c allocated st_size bytes but fscanf "%[^\n ]" appends a '\0', causing off-by-one heap overflow when a token is exactly st_size long. _find_next_bit in wd_mempool.c used "start > bits" in the loop guard while the initial guard used "start >= bits", reading map out of bounds when bits is a multiple of BITS_PER_LONG. Allocate st_size + 1 and use ">=" for the loop guard. Signed-off-by: Weili Qian <qianweili@huawei.com> --- wd.c | 3 ++- wd_mempool.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/wd.c b/wd.c index f973c70..bd0a3aa 100644 --- a/wd.c +++ b/wd.c @@ -114,11 +114,12 @@ static void wd_parse_log_level(void) goto close_file; } - file_contents = malloc(file_info.st_size); + file_contents = malloc(file_info.st_size + 1); if (!file_contents) { WD_ERR("failed to get file contents memory.\n"); goto close_file; } + file_contents[file_info.st_size] = '\0'; while (fscanf(in_file, " %[^\n ] ", file_contents) != EOF) { if (!strcmp("local5.debug", file_contents)) diff --git a/wd_mempool.c b/wd_mempool.c index 3ce9ef0..15c8d45 100644 --- a/wd_mempool.c +++ b/wd_mempool.c @@ -239,7 +239,7 @@ static unsigned long _find_next_bit(unsigned long *map, unsigned long bits, while (!tmp) { start += BITS_PER_LONG; - if (start > bits) + if (start >= bits) return bits; tmp = map[start / BITS_PER_LONG]; -- 2.50.1.windows.1