From 0386ec2544d5ce4062158c0d971f8e753080b974 Mon Sep 17 00:00:00 2001 From: Maxime Henrion Date: Thu, 9 Jul 2026 12:08:33 -0400 Subject: [PATCH] MINOR: shctx: clamp shctx_row_data_get() reads against the offset The length clamp capped the request to the whole row length but ignored , so a read starting past the beginning of the row could run beyond the stored data and copy stale bytes from the reserved tail of its blocks. No current caller reads past first->len so this was never triggered, but the helper is public and its contract does not forbid it. Clamp against (first->len - offset) instead, returning early when the offset is already at or past the stored data. This may be backported along with the shctx_row_data_get() offset fix. --- src/shctx.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/shctx.c b/src/shctx.c index cb580b14e..2d443133e 100644 --- a/src/shctx.c +++ b/src/shctx.c @@ -229,9 +229,11 @@ int shctx_row_data_get(struct shared_context *shctx, struct shared_block *first, int count, size, start = -1; struct shared_block *block; - /* can't copy more */ - if (len > first->len) - len = first->len; + /* can't copy more than what is stored past */ + if (offset >= first->len) + return len; + if (len > first->len - offset) + len = first->len - offset; /* Walk the blocks, skipping those that precede the one holding . */ for (block = first, count = 0; count < first->block_count && len > 0; -- 2.47.3