On Mon, Aug 24, 2026 at 04:26:02AM +0100, Olly Betts wrote:
> > // summary.c
> > szStart = (char *)aucBuffer + ulOffset + 8; /* summary.c:152, attacker
> > offset */
> > ...
> > szResult = xstrdup(szStart); /* strlen+strcpy over-read
> > ??? output */
>
> This looks like it is the same problem as
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008092 which the
> reporter apparently has a reproducer for but never responded when asked
> repeatedly to provide it.
>
> I did some work on a patch for that a few months ago - I'll dig it out.
I finished off that patch and it fixes this and also #1144641 (your
other OOB read bug).
Cheers,
Olly
