bug#79555: unexpand: heap-buffer-overflow

[Pádraig Brady]

On 02/10/2025 10:25, Frank Busse wrote:

Hi,


KLEE found another bug in Coreutils 9.8:

$ printf '\x00\x08\x08\t    ' | unexpand '-3t +/ +6,'

ASAN confirms:

---
==516254==ERROR: heap-buffer-overflow
WRITE of size 1 at 0x7bd06c1e01f3 thread T0
     #0 0x55fbf2552614 in unexpand src/unexpand.c:195
     #1 0x55fbf2552614 in main src/unexpand.c:316
...
---

This is an old issue introduced in coreutils-8.28 (8 years ago).
I'll fix it up.

thank you,
Padraig