Re: seq bug -- out of bounds read (off by one)

[Jim Meyering]

Daniel Dunbar <address@hidden> wrote:
> Thanks for the quick reply on the ptx bug.
>
> We have found another minor bug (non-crashing) in seq. An example problem 
> input
> is:
> --
> address@hidden:src$ ./seq -f %0 1
> ./seq: memory exhausted
> --
>
> The problem is in seq.c:213 (in 6.10 source),
>   if (! strchr ("efgaEFGA", fmt[i]))
> which I believe should be
>   if (!fmt[i] || ! strchr ("efgaEFGA", fmt[i]))

Thanks for the report.
However that particular problem was fixed a few weeks ago:

  "seq -f % 1" would issue the erroneous diagnostic "seq: memory exhausted"
  rather than reporting the invalid string format.
  [bug introduced in coreutils-6.0]

You can get the very latest sources via:

  git clone git://git.sv.gnu.org/coreutils

or a slightly older snapshot from here:

  http://meyering.net/cu/coreutils-ss.tar.gz        8.6 MB
  http://meyering.net/cu/coreutils-ss.tar.lzma      3.6 MB
  http://meyering.net/cu/coreutils-ss.tar.gz.sig
  http://meyering.net/cu/coreutils-ss.tar.lzma.sig