shithub: puzzles

Download patch

ref: 4b5422181deb3b09a7926aa51a7b26d656ca15ba
parent: f5924fc8a70fede4dda4eddb35229fc70cb5b38a
author: Ben Harris <bjh21@bjh21.me.uk>
date: Mon Jan 16 05:43:41 EST 2023

Fix use-after-free in fuzzpuzz

When reporting that the game name in a save file isn't recognised,
don't include the name from the save file in the error message, partly
to avoid the complexity of freeing it properly on two different code
paths and partly because including unsanitized data from a
fuzzer-supplied save file in the error message just seems dangerous.
And properly sanitising it would waste the fuzzer's time exploring the
sanitising code.

Thanks to Ben Hutchings for reporting the bug.

--- a/fuzzpuzz.c

+++ b/fuzzpuzz.c

@@ -81,7 +81,7 @@

                 ourgame = gamelist[i];

         sfree(gamename);

         if (ourgame == NULL) {

-            fprintf(stderr, "Game '%s' not recognised\n", gamename);

+            fprintf(stderr, "Game not recognised\n");

             ret = 1;

             continue;

         }