Hello,

I would like to report a bug in `tic` in ncurses 6.5.

Reproducer:

1. Build ncurses with sanitizers enabled:

   `CC=clang`
   `CFLAGS="-O1 -g -fno-omit-frame-pointer 
-fsanitize=address,undefined,integer,bounds"`
   `LDFLAGS="-fsanitize=address,undefined,integer,bounds"`

2. UBSan reports:

`ncurses/tinfo/comp_scan.c:285:15: runtime error: addition of unsigned offset 
to 0x619000000098 overflowed to 0x619000000097`

Backtrace:

#0  next_char() at ncurses/tinfo/comp_scan.c:285
#1  eat_escaped_newline() at ncurses/tinfo/comp_scan.c:332
#2  _nc_get_token() at ncurses/tinfo/comp_scan.c:441
#3  _nc_parse_entry() at ncurses/tinfo/parse_entry.c:297
#4  _nc_read_entry_source() at ncurses/tinfo/comp_parse.c:236
#5  main() at progs/tic.c:983

Root cause:

In `next_char()`, after leading whitespace is skipped, `strlen(bufptr)` can 
become 0.
The code then evaluates `bufptr[len - 1]` in the loop condition, which becomes 
`bufptr[-1]` when `len == 0`.

Best regards,
Lingfeng Chen <https://aka.ms/GetOutlookForMac>

Reply via email to