Comment 6 for bug 1564976

Revision history for this message
Martin Pitt (pitti) wrote :

This crashes in src/libsystemd/sd-device/sd-device.c, device_properties_prepare():

                char *tags = NULL;
                while ((tag = sd_device_get_tag_next(device)))
                        tags = strjoina(tags, ":", tag);

strjoina() (which essentially is alloca() with some automatic size determination) is very efficient with a few tags, but it has an undefined upper bound and undefined behaviour on stack overflow, i. e. there is no way to find out when it failed.