From cd345f5c03e504faca874e1da74bc966a379cedb Mon Sep 17 00:00:00 2001 From: Szabolcs Nagy Date: Fri, 18 Mar 2022 06:55:31 +0000 Subject: cheri: fix invalid pointer use after realloc in localealias This code updates pointers to a reallocated buffer to point to the new buffer. It is not conforming (does arithmetics with freed pointers), but it also creates invalid capabilities because the provenance is derived from the original freed pointers instead of the new buffer. Change the arithmetics so provenance is derived from the new buffer. The conformance issue is not fixed. --- intl/localealias.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/intl/localealias.c b/intl/localealias.c index b36092363a..0401f35f9d 100644 --- a/intl/localealias.c +++ b/intl/localealias.c @@ -340,8 +340,10 @@ read_alias_file (const char *fname, int fname_len) for (i = 0; i < nmap; i++) { - map[i].alias += new_pool - string_space; - map[i].value += new_pool - string_space; + map[i].alias = new_pool + + (map[i].alias - string_space); + map[i].value = new_pool + + (map[i].value - string_space); } } -- cgit v1.2.3