From 782449d95228dc263d305888b111be8e8d28de12 Mon Sep 17 00:00:00 2001 From: "Chao Li (Evan)" Date: Tue, 20 Oct 2026 15:26:04 +0800 Subject: [PATCH v1] Fix integer truncation in frontend pnstrdup() The frontend implementation of pnstrdup() stored the result of strnlen() in an int, even though strnlen() returns size_t and the function takes a Size length. For sufficiently large inputs, that could truncate the length and lead to incorrect allocation and copy sizes. Reuse the Size argument to hold the actual string length, matching the backend implementation and keeping the calculation in the proper type throughout. Author: Chao Li --- src/common/fe_memutils.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/common/fe_memutils.c b/src/common/fe_memutils.c index e6f8e74929c..6637e056673 100644 --- a/src/common/fe_memutils.c +++ b/src/common/fe_memutils.c @@ -151,7 +151,6 @@ char * pnstrdup(const char *in, Size size) { char *tmp; - int len; if (!in) { @@ -160,16 +159,16 @@ pnstrdup(const char *in, Size size) exit(EXIT_FAILURE); } - len = strnlen(in, size); - tmp = malloc(len + 1); + size = strnlen(in, size); + tmp = malloc(size + 1); if (tmp == NULL) { fprintf(stderr, _("out of memory\n")); exit(EXIT_FAILURE); } - memcpy(tmp, in, len); - tmp[len] = '\0'; + memcpy(tmp, in, size); + tmp[size] = '\0'; return tmp; } -- 2.50.1 (Apple Git-155)