Re: less: fix use after free bug

2022-01-01 Thread Tobias Stoeckmann
On Fri, Dec 31, 2021 at 10:29:28PM -0800, Philip Guenther wrote: > To bikeshed slightly I would be inclined to do the work progressively, > perhaps like the diff below...but your diff works too. I'm fine with your version as well. In fact I have used a comparable approach but opted out to the

Re: less: fix use after free bug

2021-12-31 Thread Philip Guenther
On Fri, Dec 31, 2021 at 6:22 AM Tobias Stoeckmann wrote: > Hi, > > it is possible to trigger a use after free bug in less with huge > files or tight memory constraints. PoC with 100 MB file: > > dd if=/dev/zero bs=1024 count=102400 | tr '\0' 'a' > less-poc.txt > ulimit -d 157286 > less

less: fix use after free bug

2021-12-31 Thread Tobias Stoeckmann
Hi, it is possible to trigger a use after free bug in less with huge files or tight memory constraints. PoC with 100 MB file: dd if=/dev/zero bs=1024 count=102400 | tr '\0' 'a' > less-poc.txt ulimit -d 157286 less less-poc.txt The linebuf and attr buffers in line.c are supposed to never be