undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Another memory overrun in http-push.c

Browse Source 
Use of strlcpy() are wrong, as the source buffer at these
locations may not be NUL-terminated.
This commit is contained in:
Eygene Ryabinkin 2007-03-01 19:09:12 +03:00 committed by Junio C Hamano
parent 0df56eabf2
commit eecc8367f4
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
http-push.c
View File

@ -1271,7 +1271,9 @@ xml_cdata(void *userData, const XML_Char *s, int len)
struct xml_ctx *ctx = (struct xml_ctx *)userData; struct xml_ctx *ctx = (struct xml_ctx *)userData;
free(ctx->cdata); free(ctx->cdata);
ctx->cdata = xmalloc(len + 1); ctx->cdata = xmalloc(len + 1);
strlcpy(ctx->cdata, s, len + 1); /* NB: 's' is not null-terminated, can not use strlcpy here */
memcpy(ctx->cdata, s, len);
ctx->cdata[len] = '\0';
} }
static struct remote_lock *lock_remote(const char *path, long timeout) static struct remote_lock *lock_remote(const char *path, long timeout)
@ -1473,7 +1475,8 @@ static void process_ls_object(struct remote_ls_ctx *ls)
return; return;
path += 8; path += 8;
obj_hex = xmalloc(strlen(path)); obj_hex = xmalloc(strlen(path));
strlcpy(obj_hex, path, 3); /* NB: path is not null-terminated, can not use strlcpy here */
memcpy(obj_hex, path, 2);
strcpy(obj_hex + 2, path + 3); strcpy(obj_hex + 2, path + 3);
one_remote_object(obj_hex); one_remote_object(obj_hex);
free(obj_hex); free(obj_hex);
@ -2170,7 +2173,8 @@ static void fetch_symref(const char *path, char **symref, unsigned char *sha1)
/* If it's a symref, set the refname; otherwise try for a sha1 */ /* If it's a symref, set the refname; otherwise try for a sha1 */
if (!strncmp((char *)buffer.buffer, "ref: ", 5)) { if (!strncmp((char *)buffer.buffer, "ref: ", 5)) {
*symref = xmalloc(buffer.posn - 5); *symref = xmalloc(buffer.posn - 5);
strlcpy(*symref, (char *)buffer.buffer + 5, buffer.posn - 5); memcpy(*symref, (char *)buffer.buffer + 5, buffer.posn - 6);
(*symref)[buffer.posn - 6] = '\0';
} else { } else {
get_sha1_hex(buffer.buffer, sha1); get_sha1_hex(buffer.buffer, sha1);
} }