Commit graph

1 commit

Author SHA1 Message Date
Dmitry Goncharov
06c75a35b9 [SV 64124] Avoid use-after-free in expand_variable_buf()
When the expanded value of the variable in buf occupies more space
than available in variable_buffer, function variable_buffer_output
reallocates variable_buffer: return a pointer into the new memory,
not the old memory.

* src/expand.c (expand_variable_buf): Preserve the offset of buf and
return that offset into the (potentially reallocated) buffer.
* tests/scripts/features/expand: Add tests.
2023-04-30 09:41:02 -04:00