fix single-byte overflow of malloc'd buffer in getdelim

the buffer enlargement logic here accounted for the terminating null
byte, but not for the possibility of hitting the delimiter in the
buffer-refill code path that uses getc_unlocked, in which case two
additional bytes (the delimiter and the null termination) are written
without another chance to enlarge the buffer.

this patch and the corresponding bug report are by Felix Janda.

diff --git a/src/stdio/getdelim.c b/src/stdio/getdelim.c
index a88c3933f86d55e007647c2a05a370b4afaaa0a6..307749080a9d4dd77432dfdeaa5e3918ea0c76bf 100644 (file)
--- a/src/stdio/getdelim.c
+++ b/src/stdio/getdelim.c
@@ -27,7 +27,7 @@ ssize_t getdelim(char **restrict s, size_t *restrict n, int delim, FILE *restric
        for (;;) {
                z = memchr(f->rpos, delim, f->rend - f->rpos);
                k = z ? z - f->rpos + 1 : f->rend - f->rpos;
-               if (i+k >= *n) {
+               if (i+k+1 >= *n) {
                        if (k >= SIZE_MAX/2-i) goto oom;
                        *n = i+k+2;
                        if (*n < SIZE_MAX/4) *n *= 2;