Details
-
Improvement
-
Status: Closed
-
Minor
-
Resolution: Fixed
-
4.2.0
-
None
-
Patch Available
-
Incorrect Behavior
Description
When prepending the default locale to the locale name array, the size of the resulting string is not modified, so later write operations can write past the end of the buffer.
-
-
-
- Purify instrumented ./22.locale.cons.stdcxx-485 (pid 13090) ****
ABW: Array bounds write:
- Purify instrumented ./22.locale.cons.stdcxx-485 (pid 13090) ****
-
-
- This is occurring while in thread 13090:
strcpy [rtlib.o]
rw_locales(int, char const*, bool) [locale.cpp:486]
run_test(int, char**) [22.locale.cons.stdcxx-485.cpp:41]
unknown func [pc=0x808b380]
rw_test(int, char*, char const, char const*, char const*, int (int, char**)) [driver.cpp:1128]
main [22.locale.cons.stdcxx-485.cpp:78] - Writing 7 bytes to 0x810d72a in the heap (1 byte at 0x810d730 illegal).
- Address 0x810d72a is 5114 bytes into a malloc'd block at 0x810c330 of 5120 bytes.
- This block was allocated from thread -1207973632:
malloc [rtlib.o]
rw_locales(int, char const*, bool) [locale.cpp:350]
run_test(int, char**) [22.locale.cons.stdcxx-485.cpp:41]
unknown func [pc=0x808b380]
rw_test(int, char*, char const, char const*, char const*, int (int, char**)) [driver.cpp:1128]