Both _dl_simple_ltoa and _dl_simple_ltoahex use buffers of size 21,

but we were feeding them strings that were just 13 bytes long...
Thanks to spudmonkey@racsa.co.cr for noticing!
 -Erik

diff --git a/ldso/ldso/ldso.c b/ldso/ldso/ldso.c
index 0d9df30..6d8b881 100644 (file)
--- a/ldso/ldso/ldso.c
+++ b/ldso/ldso/ldso.c
@@ -1179,7 +1179,7 @@ void _dl_dprintf(int fd, const char *fmt, ...)
                case 'i':
                case 'd':
                    {
-                       char tmp[13];
+                       char tmp[22];
                        num = va_arg(args, int);
                        string = _dl_simple_ltoa(tmp, num);
                        _dl_write(fd, string, _dl_strlen(string));
@@ -1188,7 +1188,7 @@ void _dl_dprintf(int fd, const char *fmt, ...)
                case 'x':
                case 'X':
                    {
-                       char tmp[13];
+                       char tmp[22];
                        num = va_arg(args, int);
                        string = _dl_simple_ltoahex(tmp, num);
                        _dl_write(fd, string, _dl_strlen(string));