ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-03-03 10:41:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

make buf_getstring fail prior to malloc if the buffer is short

Browse Source 
--HG--
branch : fuzz
This commit is contained in:
Matt Johnston 2017-05-20 23:39:01 +08:00
parent c169423051
commit 9f1c8b2f8f
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
buffer.c
View File

@ -209,6 +209,7 @@ char* buf_getstring(buffer* buf, unsigned int *retlen) {
unsigned int len; unsigned int len;
char* ret; char* ret;
void* src = NULL;
len = buf_getint(buf); len = buf_getint(buf);
if (len > MAX_STRING_LEN) { if (len > MAX_STRING_LEN) {
dropbear_exit("String too long"); dropbear_exit("String too long");
@ -217,8 +218,9 @@ char* buf_getstring(buffer* buf, unsigned int *retlen) {
if (retlen != NULL) { if (retlen != NULL) {
*retlen = len; *retlen = len;
} }
src = buf_getptr(buf, len);
ret = m_malloc(len+1); ret = m_malloc(len+1);
memcpy(ret, buf_getptr(buf, len), len); memcpy(ret, src, len);
buf_incrpos(buf, len); buf_incrpos(buf, len);
ret[len] = '\0'; ret[len] = '\0';