authorgravatar for inkryption07@gmail.comInKryption <inkryption07@gmail.com> 2026-01-10 17:35:11+01:00
committergravatar for inkryption07@gmail.comInKryption <inkryption07@gmail.com> 2026-01-10 17:43:33+01:00
log707823abdb9754bcd7c89dadc347ba3c4fed113e
treeedebbd6c8d9f2364f4929294f701ff040d323e16
parentec25b138481e16f2d73d12ed6ffacd8e7ba65e94
signaturelock-open Commit is signed but in an unrecognized format.

fix semantic UAFs in std.Io.Threaded


1 files changed, 10 insertions(+), 7 deletions(-)

lib/std/Io/Threaded.zig+10-7
......@@ -8687,14 +8687,15 @@ fn fileWritePositional(
86878687 addBuf(&iovecs, &iovlen, header);
86888688 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &iovlen, bytes);
86898689 const pattern = data[data.len - 1];
8690
8691 var splat_backup_buffer: [splat_buffer_size]u8 = undefined;
86908692 if (iovecs.len - iovlen != 0) switch (splat) {
86918693 0 => {},
86928694 1 => addBuf(&iovecs, &iovlen, pattern),
86938695 else => switch (pattern.len) {
86948696 0 => {},
86958697 1 => {
8696 var backup_buffer: [splat_buffer_size]u8 = undefined;
8697 const splat_buffer = &backup_buffer;
8698 const splat_buffer = &splat_backup_buffer;
86988699 const memset_len = @min(splat_buffer.len, splat);
86998700 const buf = splat_buffer[0..memset_len];
87008701 @memset(buf, pattern[0]);
......@@ -8865,14 +8866,15 @@ fn fileWriteStreaming(
88658866 addBuf(&iovecs, &iovlen, header);
88668867 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &iovlen, bytes);
88678868 const pattern = data[data.len - 1];
8869
8870 var splat_backup_buffer: [splat_buffer_size]u8 = undefined;
88688871 if (iovecs.len - iovlen != 0) switch (splat) {
88698872 0 => {},
88708873 1 => addBuf(&iovecs, &iovlen, pattern),
88718874 else => switch (pattern.len) {
88728875 0 => {},
88738876 1 => {
8874 var backup_buffer: [splat_buffer_size]u8 = undefined;
8875 const splat_buffer = &backup_buffer;
8877 const splat_buffer = &splat_backup_buffer;
88768878 const memset_len = @min(splat_buffer.len, splat);
88778879 const buf = splat_buffer[0..memset_len];
88788880 @memset(buf, pattern[0]);
......@@ -10996,8 +10998,8 @@ fn netReadWindows(userdata: ?*anyopaque, handle: net.Socket.Handle, data: [][]u8
1099610998 if (!have_networking) return error.NetworkDown;
1099710999 const t: *Threaded = @ptrCast(@alignCast(userdata));
1099811000
11001 var iovec_buffer: [max_iovecs_len]ws2_32.WSABUF = undefined;
1099911002 const bufs = b: {
11000 var iovec_buffer: [max_iovecs_len]ws2_32.WSABUF = undefined;
1100111003 var i: usize = 0;
1100211004 var n: usize = 0;
1100311005 for (data) |buf| {
......@@ -11493,14 +11495,15 @@ fn netWritePosix(
1149311495 addBuf(&iovecs, &msg.iovlen, header);
1149411496 for (data[0 .. data.len - 1]) |bytes| addBuf(&iovecs, &msg.iovlen, bytes);
1149511497 const pattern = data[data.len - 1];
11498
11499 var splat_backup_buffer: [splat_buffer_size]u8 = undefined;
1149611500 if (iovecs.len - msg.iovlen != 0) switch (splat) {
1149711501 0 => {},
1149811502 1 => addBuf(&iovecs, &msg.iovlen, pattern),
1149911503 else => switch (pattern.len) {
1150011504 0 => {},
1150111505 1 => {
11502 var backup_buffer: [splat_buffer_size]u8 = undefined;
11503 const splat_buffer = &backup_buffer;
11506 const splat_buffer = &splat_backup_buffer;
1150411507 const memset_len = @min(splat_buffer.len, splat);
1150511508 const buf = splat_buffer[0..memset_len];
1150611509 @memset(buf, pattern[0]);