Fix buffer overflow in make-docfile

* lib-src/make-docfile.c (scan_c_stream): Check for buffer
overflow when reading an identifier.  Use a static buffer for NAME
rather than a small dynamically-allocated buffer.

1 files changed, 3 insertions, 13 deletions

diff --git a/lib-src/make-docfile.c b/lib-src/make-docfile.c
index 53970a06238..9470bd635f5 100644
--- a/lib-src/make-docfile.c
+++ b/lib-src/make-docfile.c
@@ -845,8 +845,7 @@ scan_c_stream (FILE *infile)
       bool defvarperbufferflag = false;
       bool defvarflag = false;
       enum global_type type = INVALID;
-      static char *name;
-      static ptrdiff_t name_size;
+      static char name[sizeof input_buffer];
 
       if (c != '\n' && c != '\r')
         {
@@ -967,22 +966,13 @@ scan_c_stream (FILE *infile)
               if (c < 0)
                 goto eof;
               input_buffer[i++] = c;
+              if (sizeof input_buffer <= i)
+                fatal ("identifier too long");
               c = getc (infile);
             }
           while (! (c == ',' || c == ' ' || c == '\t'
                     || c == '\n' || c == '\r'));
           input_buffer[i] = '\0';
-
-          if (name_size <= i)
-            {
-              free (name);
-              name_size = i + 1;
-              ptrdiff_t doubled;
-              if (! INT_MULTIPLY_WRAPV (name_size, 2, &doubled)
-                  && doubled <= SIZE_MAX)
-                name_size = doubled;
-              name = xmalloc (name_size);
-            }
           memcpy (name, input_buffer, i + 1);
 
           if (type == SYMBOL)