Re: [bug-gawk] out of bounds heap read in yyerror

[Aharon Robbins]

Hi.

> Thanks for the fix.
>
> However using the latest git head code with the fix the same input file
> will trigger another bug and it seems even more severe: a strcpy
> writing several bytes out of bounds.

Interestingly, this only appeared in master. Not sure why. Fix is
below. I've already committed and pushed to the repo.

Thanks,

Arnold
--------------------
diff --git a/awkgram.y b/awkgram.y
index 88f5e20..7805f14 100644
--- a/awkgram.y
+++ b/awkgram.y
@@ -2316,7 +2316,8 @@ yyerror(const char *m, ...)
        count = strlen(mesg) + 1;
        if (lexptr != NULL)
                count += (lexeme - thisline) + 2;
-       emalloc(buf, char *, count, "yyerror");
+       emalloc(buf, char *, count+1, "yyerror");
+       memset(buf, 0, count+1);
 
        bp = buf;