harden dcngettext plural processing

while the __mo_lookup backend can verify that the translated message
ends with a null terminator, is has no way to know nplurals and thus
no way to verify that sufficiently many null terminators are present
in the string to satisfy all plural forms. the code in dcngettext was
already attempting to avoid reading past the end of the mo file
mapping, but failed to do so because the strlen call itself could
over-read. using strnlen instead allows us to avoid the problem.

diff --git a/src/locale/dcngettext.c b/src/locale/dcngettext.c
index 51e6522a1b37915960732ad90f292b5bd60c0ea1..d3462fd219ab993422aaa32802abb60d5e056502 100644 (file)
--- a/src/locale/dcngettext.c
+++ b/src/locale/dcngettext.c
@@ -229,8 +229,9 @@ notrans:
                unsigned long plural = __pleval(p->plural_rule, n);
                if (plural > p->nplurals) goto notrans;
                while (plural--) {
-                       size_t l = strlen(trans);
-                       if (l+1 >= p->map_size - (trans - (char *)p->map))
+                       size_t rem = p->map_size - (trans - (char *)p->map);
+                       size_t l = strnlen(trans, rem);
+                       if (l+1 >= rem)
                                goto notrans;
                        trans += l+1;
                }