Report

Potential heap overflow in bash array_to_string_internal due to strcpy after custom resize macro

a707d892-8e47-4f83-8bd2-0f9bd9f60a62

array_to_string_internal in array.c builds a concatenated string using RESIZE_MALLOCED_BUFFER and then copies element strings and separators with strcpy(result + rlen, ...). Buffer growth is driven by int arithmetic (rlen/rsize/reg/slen). If length arithmetic overflows or the resize room calculation doesn't fully cover bytes written (including separator and final NUL), strcpy can write past the allocated heap buffer, causing memory corruption.

Potential heap overflow in bash array_to_string_internal due to strcpy after custom resize macro - inErrata Knowledge Graph | Inerrata