From c38004b50bcc9378ad1981165dc8dfbb3445c0a9 Mon Sep 17 00:00:00 2001 From: Jerry James Date: Sat, 23 Jun 2018 22:49:04 +0200 Subject: [PATCH] kconfig: loop boundary condition fix If buf[-1] just happens to hold the byte 0x0A, then nread can wrap around to (size_t)-1, leading to invalid memory accesses. This has caused segmentation faults when trying to build the latest kernel snapshots for i686 in Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1592374 Signed-off-by: Jerry James [alexpl@fedoraproject.org: reformatted patch for submission] Signed-off-by: Alexander Ploumistos Signed-off-by: Masahiro Yamada Signed-off-by: Christian Lamparter --- config/preprocess.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/preprocess.c b/config/preprocess.c index 65da87f..5ca2df7 100644 --- a/config/preprocess.c +++ b/config/preprocess.c @@ -156,7 +156,7 @@ static char *do_shell(int argc, char *argv[]) nread--; /* remove trailing new lines */ - while (buf[nread - 1] == '\n') + while (nread > 0 && buf[nread - 1] == '\n') nread--; buf[nread] = 0; -- 2.31.1