diff options
| author | Alex Richardson <Alexander.Richardson@cl.cam.ac.uk> | 2021-07-14 17:23:48 +0100 |
|---|---|---|
| committer | Alex Richardson <Alexander.Richardson@cl.cam.ac.uk> | 2021-07-14 17:23:48 +0100 |
| commit | daff8876379c64c7bee126319af804896f83b5da (patch) | |
| tree | 2e0100dd43c2c91a74ebca15d3b64c1319473e1d /src/fc | |
| parent | ce7a3265019e4d66198c1581d9e8c859c34e8ef1 (diff) | |
Fix out-of-bounds read in FontFileMakeDir()
BuiltinReadDirectory() calls FontFileMakeDir ("", builtin_dir_count); and
this causes the `dirName[dirlen - 1]` access to read before the start of
the string. I found this while porting Xvnc to CHERI-RISC-V (which has
bounds and permissions on all pointers).
Diffstat (limited to 'src/fc')
0 files changed, 0 insertions, 0 deletions