Re: out of bounds read in tag_expand

[Gavin Smith]

On 23 January 2017 at 21:59, Hanno Böck <address@hidden> wrote:
> And one more heap out of bounds read, visible with address sanitizer.
>
>
> Stack trace:
>
> ==12951==ERROR: AddressSanitizer: heap-buffer-overflow on address 
> 0x60200000df40 at pc 0x0000004969bf bp 0x7ffe36779500 sp 0x7ffe36778cb0
> READ of size 2 at 0x60200000df40 thread T0
>     #0 0x4969be in __interceptor_memcmp.part.69 (/r/texinfo/ginfo+0x4969be)
>     #1 0x579aa7 in tag_expand /f/texinfo/trunk/info/tag.c:221:7
>     #2 0x525d16 in scan_info_tag /f/texinfo/trunk/info/info-utils.c:1533:7
>     #3 0x525d16 in scan_node_contents /f/texinfo/trunk/info/info-utils.c:1707
>     #4 0x54c9b7 in info_node_of_tag_ext /f/texinfo/trunk/info/nodes.c:1452:11
>     #5 0x54ad69 in info_node_of_tag /f/texinfo/trunk/info/nodes.c:1493:10
>     #6 0x54ad69 in info_get_node_of_file_buffer 
> /f/texinfo/trunk/info/nodes.c:1115
>     #7 0x54a573 in info_get_node_with_defaults 
> /f/texinfo/trunk/info/nodes.c:998:14
>     #8 0x56dea2 in dump_node_to_stream /f/texinfo/trunk/info/session.c:3764:10
>     #9 0x56db72 in dump_nodes_to_file /f/texinfo/trunk/info/session.c:3727:11
>     #10 0x531d99 in main /f/texinfo/trunk/info/info.c:1073:7
>     #11 0x7f6b91f1178f in __libc_start_main (/lib64/libc.so.6+0x2078f)
>     #12 0x41a598 in _start (/r/texinfo/ginfo+0x41a598)
>
> 0x60200000df40 is located 0 bytes to the right of 16-byte region 
> [0x60200000df30,0x60200000df40)
> allocated by thread T0 here:

Should be fixed now.