Fix memory access bug

ASan detects buffer overflow in sscanf:
=================================================================
==32415==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffed06b6d28 at pc 0x7fcaf8340ce6 bp 0x7ffed06b6a80 sp 0x7ffed06b6230
WRITE of size 201 at 0x7ffed06b6d28 thread T0
    #0 0x7fcaf8340ce5  (/lib64/libasan.so+0x4ace5)
    #1 0x7fcaf83415f2 in __interceptor_vsscanf (/lib64/libasan.so+0x4b5f2)
    #2 0x7fcaf83416cc in sscanf (/lib64/libasan.so+0x4b6cc)
    #3 0x4414d7 in setup_multitable_parameters /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/multi.c:216
    #4 0x4414d7 in do_multitable /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/multi.c:365
    #5 0x4228cc in begin_insertion /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/insertion.c:611
    #6 0x43a423 in read_command /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/makeinfo.c:2155
    #7 0x43a423 in reader_loop /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/makeinfo.c:2327
    #8 0x43da41 in convert_from_loaded_file /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/makeinfo.c:1725
    #9 0x403c2a in convert_from_file /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/makeinfo.c:1426
    #10 0x403c2a in main /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/makeinfo.c:891
    #11 0x7fcaf7f7e1f0 in __libc_start_main (/lib64/libc.so.6+0x201f0)
    #12 0x404b49 in _start (/home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/makeinfo+0x404b49)

Address 0x7ffed06b6d28 is located in stack of thread T0 at offset 296 in frame
    #0 0x44116f in do_multitable /home/abuild/rpmbuild/BUILD/texinfo-4.13/makeinfo/multi.c:343

  This frame has 2 object(s):
    [32, 36) 'columnfrac'
    [96, 296) 'command' <== Memory access at offset 296 overflows this variable

SUMMARY: AddressSanitizer: AddressSanitizer stack-buffer-overflow (/lib64/libasan.so+0x4ace5)
Shadow bytes around the buggy address:
  0x10005a0ced50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10005a0ced60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10005a0ced70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10005a0ced80: f1 f1 f1 f1 04 f4 f4 f4 f2 f2 f2 f2 00 00 00 00
  0x10005a0ced90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10005a0ceda0: 00 00 00 00 00[f4]f4 f4 00 00 00 00 00 00 00 00
  0x10005a0cedb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
  0x10005a0cedc0: f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 f4 f4 f4 f2 f2
  0x10005a0cedd0: f2 f2 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00
  0x10005a0cede0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10005a0cedf0: 00 00 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Command: ..//makeinfo/makeinfo -I . -o texinfo texinfo.txi

Change-Id: I873eaac4fd162829dd082619146a60c7f463d20e
Signed-off-by: Slava Barinov <v.barinov@samsung.com>

diff --git a/makeinfo/multi.c b/makeinfo/multi.c
index 43033a2..eed500b 100644 (file)
--- a/makeinfo/multi.c
+++ b/makeinfo/multi.c
@@ -197,7 +197,7 @@ setup_multitable_parameters (void)
   char *params = insertion_stack->item_function;
   int nchars;
   float columnfrac;
-  char command[200]; /* xx no fixed limits */
+  char command[201]; /* xx no fixed limits */
   int i = 1;
 
   /* We implement @hsep and @vsep even though TeX doesn't.