From ec0ae7d831f4a34518e176681eece4f765f1d786 Mon Sep 17 00:00:00 2001 From: Jacqueline Garrahan Date: Tue, 14 Jul 2026 15:22:30 -0700 Subject: [PATCH] errlog: fix out-of-bounds read when resizing the print buffer errlogBufResize copied the print buffer from &pvt.print->base (the address of the char* field inside the buffer_t struct) instead of pvt.print->base (the buffer it points to), reading bufSize bytes from an ~8-byte struct field. Drop the stray & so it reads the actual buffer, matching the adjacent log-buffer copy. Co-Authored-By: Claude Opus 4.8 (1M context) --- modules/libcom/src/error/errlog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/libcom/src/error/errlog.c b/modules/libcom/src/error/errlog.c index 6239f1921..4e7222952 100644 --- a/modules/libcom/src/error/errlog.c +++ b/modules/libcom/src/error/errlog.c @@ -638,7 +638,7 @@ void errlogBufResize(struct initArgs config) memcpy(logbuf, pvt.log->base, pvt.bufSize); pvt.log->base = logbuf; - memcpy(printbuf, &pvt.print->base, pvt.bufSize); + memcpy(printbuf, pvt.print->base, pvt.bufSize); pvt.print->base = printbuf; pvt.bufSize = config.bufsize;