You are viewing a plain text version of this content. The canonical link for it is here.
Posted to c-commits@axis.apache.org by ro...@apache.org on 2026/09/02 22:44:24 UTC
(axis-axis2-c-core) 01/02: Pass both arguments to the two-conversion ADB name patterns
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit c79e84cd89df619947ae21629b3c4a3a16e61310
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Wed Sep 2 10:09:56 2026 -1000
Pass both arguments to the two-conversion ADB name patterns
The guard looked for "%s_%s", which adb_%s_get_%s and adb_%s_set_%s do not
contain, so both fell to the single-argument branch and the trailing %s read
an unset register. Count the conversions instead. ASan in CI caught this as
a SEGV in snprintf; it survives locally only because the garbage pointer
happens to be readable.
Co-Authored-By: Claude <no...@anthropic.com>
---
.../test/src/test_axis2c_1616_type_name_conflict.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/tools/codegen/native/test/src/test_axis2c_1616_type_name_conflict.c b/tools/codegen/native/test/src/test_axis2c_1616_type_name_conflict.c
index 2fcaf2b37..49b81e02f 100644
--- a/tools/codegen/native/test/src/test_axis2c_1616_type_name_conflict.c
+++ b/tools/codegen/native/test/src/test_axis2c_1616_type_name_conflict.c
@@ -312,11 +312,22 @@ adb_test_result_t test_axis2c_1616_function_naming_conflicts(void) {
for (int i = 0; i < pattern_count; i++) {
char *function_name = adb_tracked_malloc(256);
if (function_name) {
- if (strstr(patterns[i].pattern, "%s_%s")) {
- /* Pattern with two placeholders */
+ /* Count the conversions rather than looking for "%s_%s". The two
+ * placeholder patterns are adb_%s_get_%s and adb_%s_set_%s, and
+ * neither contains "%s_%s" -- there is a "get_"/"set_" in between.
+ * So both took the single-argument branch below and handed a
+ * two-conversion format one argument, leaving the second %s to
+ * read whatever happened to be in the register. */
+ int placeholders = 0;
+ const char *scan = patterns[i].pattern;
+ while ((scan = strstr(scan, "%s")) != NULL) {
+ placeholders++;
+ scan += 2;
+ }
+
+ if (placeholders == 2) {
snprintf(function_name, 256, patterns[i].pattern, conflicting_element, "value");
} else {
- /* Pattern with one placeholder */
snprintf(function_name, 256, patterns[i].pattern, conflicting_element);
}