From 5573661fc2a3e2458ef8cd29e00bea83bb67392e Mon Sep 17 00:00:00 2001 From: Yun-Hao Chung Date: Fri, 1 Nov 2024 15:19:39 +0800 Subject: [PATCH] textfile: Fix possible bad memory access in find_key If the searched key is a prefix of the first key in the textfile, the code will assume it's not the first line which is wrong. The issue can be reproduced by a fuzzer. More context can be found in https://issues.oss-fuzz.com/issues/42515619 To reproduce the issue, please kindly follow the instructions in https://google.github.io/oss-fuzz/advanced-topics/reproducing/ Stack trace: #0 0x55e1c450e7ce in find_key /src/bluez/src/textfile.c:133:9 #1 0x55e1c450e7ce in write_key /src/bluez/src/textfile.c:244:8 #2 0x55e1c450dc33 in LLVMFuzzerTestOneInput /src/fuzz_textfile.c:61:3 (...trace in fuzzer) --- src/textfile.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/textfile.c b/src/textfile.c index 313098f38..8188d2ebe 100644 --- a/src/textfile.c +++ b/src/textfile.c @@ -127,10 +127,10 @@ static inline char *find_key(char *map, size_t size, const char *key, size_t len while (ptrlen > len + 1) { int cmp = (icase) ? strncasecmp(ptr, key, len) : strncmp(ptr, key, len); if (cmp == 0) { - if (ptr == map && *(ptr + len) == ' ') - return ptr; - - if ((*(ptr - 1) == '\r' || *(ptr - 1) == '\n') && + if (ptr == map) { + if (*(ptr + len) == ' ') + return ptr; + } else if ((*(ptr - 1) == '\r' || *(ptr - 1) == '\n') && *(ptr + len) == ' ') return ptr; }