1 files changed, 35 insertions, 0 deletions
diff --git a/main/musl/memmem.patch b/main/musl/memmem.patch
new file mode 100644
index 0000000000..9753dabbb7
--- /dev/null
+++ b/main/musl/memmem.patch
@@ -0,0 +1,35 @@
+From c718f9fc1b4bd913eff10d0c12763f90b2bc487c Mon Sep 17 00:00:00 2001
+From: Rich Felker <dalias@aerifal.cx>
+Date: Fri, 1 Apr 2016 13:36:15 -0400
+Subject: fix read past end of haystack buffer for short needles in memmem
+
+the two/three/four byte memmem specializations are not prepared to
+handle haystacks shorter than the needle; they unconditionally read at
+least up to the needle length and subtract from the haystack length.
+if the haystack is shorter, the remaining haystack length underflows
+and produces an unbounded search which will eventually either crash or
+find a spurious match.
+
+the top-level memmem function attempted to avoid this case already by
+checking for haystack shorter than needle, but it failed to re-check
+after using memchr to remove the maximal prefix not containing the
+first byte of the needle.
+---
+ src/string/memmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/string/memmem.c b/src/string/memmem.c
+index d7e1221..4be6a31 100644
+--- a/src/string/memmem.c
++++ b/src/string/memmem.c
+@@ -140,6 +140,7 @@ void *memmem(const void *h0, size_t k, const void *n0, size_t l)
+ 	h = memchr(h0, *n, k);
+ 	if (!h || l==1) return (void *)h;
+ 	k -= h - (const unsigned char *)h0;
++	if (k<l) return 0;
+ 	if (l==2) return twobyte_memmem(h, k, n);
+ 	if (l==3) return threebyte_memmem(h, k, n);
+ 	if (l==4) return fourbyte_memmem(h, k, n);
+-- 
+cgit v0.11.2
+