19 Aug
2025
19 Aug
'25
4:23 p.m.
Esme Povirk (@madewokherd) commented about dlls/sane.ds/cfg.c:
+ while (line && count < 1000) + { + if (!found && strstr(line, search) == line) + { + lines[count++] = buffer; + found = TRUE; + } + else + { + lines[count++] = strdup(line); + } + line = strtok_s(NULL, "\n", &context); + } + if (!found) + { + lines[count++] = buffer; This could write past the end of `lines`.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/8778#note_113166