[bug #64124] Use after free in expand_variable_buf.

[Dmitry Goncharov]

Follow-up Comment #1, bug #64124 (project make):

There is use after free in expand_variable_buf.
    
When the expanded value of the variable in buf occupies more space than
avaiable in variable_buffer, function variable_buffer_output reallocates
variable_buffer.
This reallocation leaves buf in expand_variable_buf to point to an already
freed region of memory.
Can be observed by with a sufficiently large value of MAKEFLAGS.


$ cat makefile 
$(info hello=$(hello))
all:
$ v=12345
$ echo ${#v}
5
$ MAKEFLAGS=" -- hello=$v" make
hello=12345
make: Nothing to be done for 'all'.
$ v=$( for k in {1..90}; do echo -n $k; done )
$ echo ${#v}
171
$ MAKEFLAGS=" -- hello=$v" make
hello=123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990
                                                                              
   
make: Nothing to be done for 'all'.
$ v=$( for k in {1..110}; do echo -n $k; done )
$ echo ${#v}
222
$ MAKEFLAGS=" -- hello=$v" make
: invalid option -- '�'
: invalid option -- '�'
: invalid option -- '�'
: invalid option -- '�'
: invalid option -- '^'
: invalid option -- 'U'
Usage: make [options] [target] ...
Options:
  -b, -m                      Ignored for compatibility.
  -B, --always-make           Unconditionally make all targets.
...




    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?64124>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/