Skip to content

xfree86: loader: Fix memory/array bugs in loadmod. - #4078

Open
b-aaz wants to merge 1 commit into
X11Libre:masterfrom
b-aaz:loadmod_fix
Open

b-aaz wants to merge 1 commit into
X11Libre:masterfrom
b-aaz:loadmod_fix

Conversation

@b-aaz

@b-aaz b-aaz commented Nov 10, 2026

Copy link
Copy Markdown
Contributor

sizeof was incorrectly used to get the length of an string in an array of char pointers (array of strings), which always returns the system's pointer size (8 on 64bit) instead of the actual string length. Was fixed by using strlen instead.

Additionally the final step that appended the returning array of strings with another array of strings, also used an incorrect memcpy function to copy the elements.
Was fixed by using an explicit for loop.

And I also replaced the 'length' variables' type's with the proper size_t type instead of int, where possible.

Issue and patch from:

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299077

`sizeof` was incorrectly used to get the length of an string in an array
of char pointers (array of strings), which always returns the system's
pointer size (8 on 64bit) instead of the actual string length.
Was fixed by using `strlen` instead.

Additionally the final step that appended the returning array of strings
with another array of strings, also used an incorrect `memcpy` function
to copy the elements.
Was fixed by using an explicit for loop.

And I also replaced the 'length' variables' type's with the proper
`size_t` type instead of `int`, where possible.

Issue and patch from:

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299077

Signed-off-by: b-aaz <b-aazbsd@proton.me>
@b-aaz
b-aaz requested a review from stefan11111 November 10, 2026 14:24

ret = tmp;
memcpy(ret + oldlen, subret, sublen);
for (size_t i = 0; i < sublen; i++) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

woudn't be same, if used

memcpy(&ret[oldlen], subret,sublen);
``` ?

@cepelinas9000

Copy link
Copy Markdown
Contributor

LGTM I assume in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299077 tested it.

@cepelinas9000
cepelinas9000 self-requested a review November 12, 2026 10:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants