authorgravatar for inkryption07@gmail.comInKryption <inkryption07@gmail.com> 2026-01-10 17:35:11+01:00
committergravatar for inkryption07@gmail.comInKryption <inkryption07@gmail.com> 2026-01-10 17:43:33+01:00
log707823abdb9754bcd7c89dadc347ba3c4fed113e
treeedebbd6c8d9f2364f4929294f701ff040d323e16
parentec25b138481e16f2d73d12ed6ffacd8e7ba65e94
signaturelock-open Commit is signed but in an unrecognized format.

fix semantic UAFs in std.Io.Threaded

1 files changed, 10 insertions(+), 7 deletions(-)

lib/std/Io/Threaded.zig+10-7
...@@ -8687,14 +8687,15 @@ fn fileWritePositional(...@@ -8687,14 +8687,15 @@ fn fileWritePositional(
8687 addBuf(&iovecs, &iovlen, header);8687 addBuf(&iovecs, &iovlen, header);
8688 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &iovlen, bytes);8688 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &iovlen, bytes);
8689 const pattern = data[data.len - 1];8689 const pattern = data[data.len - 1];
8690
8691 var splat_backup_buffer: [splat_buffer_size]u8 = undefined;
8690 if (iovecs.len - iovlen != 0) switch (splat) {8692 if (iovecs.len - iovlen != 0) switch (splat) {
8691 0 => {},8693 0 => {},
8692 1 => addBuf(&iovecs, &iovlen, pattern),8694 1 => addBuf(&iovecs, &iovlen, pattern),
8693 else => switch (pattern.len) {8695 else => switch (pattern.len) {
8694 0 => {},8696 0 => {},
8695 1 => {8697 1 => {
8696 var backup_buffer: [splat_buffer_size]u8 = undefined;8698 const splat_buffer = &splat_backup_buffer;
8697 const splat_buffer = &backup_buffer;
8698 const memset_len = @min(splat_buffer.len, splat);8699 const memset_len = @min(splat_buffer.len, splat);
8699 const buf = splat_buffer[0..memset_len];8700 const buf = splat_buffer[0..memset_len];
8700 @memset(buf, pattern[0]);8701 @memset(buf, pattern[0]);
...@@ -8865,14 +8866,15 @@ fn fileWriteStreaming(...@@ -8865,14 +8866,15 @@ fn fileWriteStreaming(
8865 addBuf(&iovecs, &iovlen, header);8866 addBuf(&iovecs, &iovlen, header);
8866 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &iovlen, bytes);8867 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &iovlen, bytes);
8867 const pattern = data[data.len - 1];8868 const pattern = data[data.len - 1];
8869
8870 var splat_backup_buffer: [splat_buffer_size]u8 = undefined;
8868 if (iovecs.len - iovlen != 0) switch (splat) {8871 if (iovecs.len - iovlen != 0) switch (splat) {
8869 0 => {},8872 0 => {},
8870 1 => addBuf(&iovecs, &iovlen, pattern),8873 1 => addBuf(&iovecs, &iovlen, pattern),
8871 else => switch (pattern.len) {8874 else => switch (pattern.len) {
8872 0 => {},8875 0 => {},
8873 1 => {8876 1 => {
8874 var backup_buffer: [splat_buffer_size]u8 = undefined;8877 const splat_buffer = &splat_backup_buffer;
8875 const splat_buffer = &backup_buffer;
8876 const memset_len = @min(splat_buffer.len, splat);8878 const memset_len = @min(splat_buffer.len, splat);
8877 const buf = splat_buffer[0..memset_len];8879 const buf = splat_buffer[0..memset_len];
8878 @memset(buf, pattern[0]);8880 @memset(buf, pattern[0]);
...@@ -10996,8 +10998,8 @@ fn netReadWindows(userdata: ?*anyopaque, handle: net.Socket.Handle, data: [][]u8...@@ -10996,8 +10998,8 @@ fn netReadWindows(userdata: ?*anyopaque, handle: net.Socket.Handle, data: [][]u8
10996 if (!have_networking) return error.NetworkDown;10998 if (!have_networking) return error.NetworkDown;
10997 const t: *Threaded = @ptrCast(@alignCast(userdata));10999 const t: *Threaded = @ptrCast(@alignCast(userdata));
1099811000
11001 var iovec_buffer: [max_iovecs_len]ws2_32.WSABUF = undefined;
10999 const bufs = b: {11002 const bufs = b: {
11000 var iovec_buffer: [max_iovecs_len]ws2_32.WSABUF = undefined;
11001 var i: usize = 0;11003 var i: usize = 0;
11002 var n: usize = 0;11004 var n: usize = 0;
11003 for (data) |buf| {11005 for (data) |buf| {
...@@ -11493,14 +11495,15 @@ fn netWritePosix(...@@ -11493,14 +11495,15 @@ fn netWritePosix(
11493 addBuf(&iovecs, &msg.iovlen, header);11495 addBuf(&iovecs, &msg.iovlen, header);
11494 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &msg.iovlen, bytes);11496 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &msg.iovlen, bytes);
11495 const pattern = data[data.len - 1];11497 const pattern = data[data.len - 1];
11498
11499 var splat_backup_buffer: [splat_buffer_size]u8 = undefined;
11496 if (iovecs.len - msg.iovlen != 0) switch (splat) {11500 if (iovecs.len - msg.iovlen != 0) switch (splat) {
11497 0 => {},11501 0 => {},
11498 1 => addBuf(&iovecs, &msg.iovlen, pattern),11502 1 => addBuf(&iovecs, &msg.iovlen, pattern),
11499 else => switch (pattern.len) {11503 else => switch (pattern.len) {
11500 0 => {},11504 0 => {},
11501 1 => {11505 1 => {
11502 var backup_buffer: [splat_buffer_size]u8 = undefined;11506 const splat_buffer = &splat_backup_buffer;
11503 const splat_buffer = &backup_buffer;
11504 const memset_len = @min(splat_buffer.len, splat);11507 const memset_len = @min(splat_buffer.len, splat);
11505 const buf = splat_buffer[0..memset_len];11508 const buf = splat_buffer[0..memset_len];
11506 @memset(buf, pattern[0]);11509 @memset(buf, pattern[0]);