[PATCH] erofs-utils: lib: fix build warning in ocierofs_encode_userpass()

Gao Xiang hsiangkao at linux.alibaba.com
Thu Oct 23 13:10:19 AEDT 2025


remotes/oci.c: In function 'ocierofs_encode_userpass':
remotes/oci.c:1567:20: warning: array subscript [-2147483648, -1] is outside array bounds of 'char[2147483648]' [-Warray-bounds]
 1567 |                 out[ret] = '\0';
      |                 ~~~^~~~~
remotes/oci.c:1560:15: note: at offset [-2147483648, -1] into object of size [0, 2147483648] allocated by 'malloc'
 1560 |         out = malloc(outlen + 1);
      |               ^~~~~~~~~~~~~~~~~~
remotes/oci.c:1567:20: warning: pointer 'out' used after 'free' [-Wuse-after-free]
 1567 |                 out[ret] = '\0';
      |                    ^
remotes/oci.c:1566:25: note: call to 'free' here
 1566 |                         free(out);
      |                         ^~~~~~~~~

Cc: Chengyu Zhu <hudsonzhu at tencent.com>
Signed-off-by: Gao Xiang <hsiangkao at linux.alibaba.com>
---
 lib/remotes/oci.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/lib/remotes/oci.c b/lib/remotes/oci.c
index 25f991d..38b3f01 100644
--- a/lib/remotes/oci.c
+++ b/lib/remotes/oci.c
@@ -1549,24 +1549,26 @@ int ocierofs_io_open(struct erofs_vfile *vfile, const struct ocierofs_config *cf
 
 char *ocierofs_encode_userpass(const char *username, const char *password)
 {
-	char *buf, *out;
-	int ret;
+	char *userpw, *out;
 	size_t outlen;
+	int ret;
 
-	ret = asprintf(&buf, "%s:%s", username ?: "", password ?: "");
-	if (ret == -1)
+	ret = asprintf(&userpw, "%s:%s", username ?: "", password ?: "");
+	if (ret < 0)
 		return ERR_PTR(-ENOMEM);
+
 	outlen = 4 * DIV_ROUND_UP(ret, 3);
 	out = malloc(outlen + 1);
 	if (!out) {
 		ret = -ENOMEM;
 	} else {
-		ret = erofs_base64_encode((unsigned char *)buf, ret, out);
+		ret = erofs_base64_encode((u8 *)userpw, ret, out);
 		if (ret < 0)
 			free(out);
-		out[ret] = '\0';
+		else
+			out[ret] = '\0';
 	}
-	free(buf);
+	free(userpw);
 	return ret < 0 ? ERR_PTR(ret) : out;
 }
 
-- 
2.39.5



More information about the Linux-erofs mailing list