From: Keith Packard <keithp@keithp.com>
Date: Wed, 28 Dec 2022 05:31:38 +0000 (-0800)
Subject: ao-tools: Fix buffer overflow in lib/ao-hex.c
X-Git-Tag: 1.9.13~1^2~13
X-Git-Url: https://git.gag.com/?p=fw%2Faltos;a=commitdiff_plain;h=95d39febfa9b6c6f2696fb1b47cf72aa808ec7c9

ao-tools: Fix buffer overflow in lib/ao-hex.c

ao_hex_file_create allocated a buffer too short when writing EOF.

Signed-off-by: Keith Packard <keithp@keithp.com>
---

diff --git a/ao-tools/lib/ao-hex.c b/ao-tools/lib/ao-hex.c
index 73f3d7be..c275baaf 100644
--- a/ao-tools/lib/ao-hex.c
+++ b/ao-tools/lib/ao-hex.c
@@ -565,7 +565,7 @@ ao_hex_file_create(struct ao_hex_image *image, struct ao_sym *symbols, int num_s
 
 	/* Stick an EOF after the data
 	 */
-	record = calloc(sizeof (struct ao_hex_record), 1);
+	record = calloc(1,sizeof (struct ao_hex_record) + 2);
 	record->type = AO_HEX_RECORD_EOF;
 	record->address = 0;
 	record->length = 0;