diff --git a/NEWS b/NEWS index 81c4cbcdf..57a22fc8f 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,10 @@ Any uppercase BUG_* names are modernish shell bug IDs. (unset PATH; PATH=/dev/null; ls); : wrongly ran 'ls' (unset LC_ALL; LC_ALL=badlocale); : failed to print a diagnostic +- Fix crashes on some systems, including at least a crash in 'print -v' on + macOS, by eliminating an invalid/undefined use of memccpy() on overlapping + buffers in the commonly used sfputr() function. + 2020-06-04: - Fix BUG_KBGPID: the $! special parameter was not set if a background job diff --git a/src/lib/libast/sfio/sfputr.c b/src/lib/libast/sfio/sfputr.c index 21bfb0aeb..0d0f65124 100644 --- a/src/lib/libast/sfio/sfputr.c +++ b/src/lib/libast/sfio/sfputr.c @@ -105,16 +105,15 @@ int rc; /* record separator. */ break; } -#if _lib_memccpy && !__ia64 /* these guys may never get it right */ - if((ps = (uchar*)memccpy(ps,s,'\0',p)) != NIL(uchar*)) - ps -= 1; - else ps = f->next+p; - s += ps - f->next; -#else + /* + * Do not replace the following loop with memccpy(). The + * 'ps' and 's' buffers may overlap or even point to the + * same buffer. See: https://github.com/att/ast/issues/78 + */ for(; p > 0; --p, ++ps, ++s) if((*ps = *s) == 0) break; -#endif + w += ps - f->next; f->next = ps; }