split: fix memory corruption during chunk extraction
commit4954f79ad2e38e4198af301bf52c3562af39d482
authorPádraig Brady <P@draigBrady.com>
Thu, 24 Nov 2016 00:03:16 +0000 (24 00:03 +0000)
committerPádraig Brady <P@draigBrady.com>
Thu, 24 Nov 2016 00:24:58 +0000 (24 00:24 +0000)
tree35d483735ba93b4c1ec83de456e7b667c2083abc
parent68c5eeccd0365a6953d292550ffa5c537fa00f90
split: fix memory corruption during chunk extraction

ASAN reported this error for: split -n2/3 /dev/null
  ERROR: AddressSanitizer: negative-size-param: (size=-1)
  #0 0x7f0d4c36951d in __asan_memmove (/lib64/libasan.so.2+0x8d51d)
  #1 0x404e06 in memmove /usr/include/bits/string3.h:59
  #2 0x404e06 in bytes_chunk_extract src/split.c:988
  #3 0x404e06 in main src/split.c:1626

Specifically there would be invalid memory access
and subsequent processing if the chunk to be extracted
was beyond the initial amount read from file (which is
currently capped at 128KiB).  This issue is not in a
released version, only being introduced in commit v8.25-4-g62e7af0

* src/split.c (bytes_chunk_extract): The initial_read != SIZE_MAX
should have been combined with && rather than ||, but also this
condition is always true in this function so remove entirely.
* tests/split/b-chunk.sh: Add a test case.

Fixes http://bugs.gnu.org/25003
src/split.c
tests/split/b-chunk.sh