tallship
/
bitchx
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid reading an uninitialized byte in dgets() 

This was caused by an off-by-one error in the case when a line exceeded the buffer size provided to
dgets().  Found with valgrind.
This commit is contained in:
Kevin Easton 2019-06-27 17:37:35 +10:00
parent 6ef78086f8
commit b9803e69d1
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
source/newio.c
View File

@ -349,19 +349,16 @@ int BX_dgets (char *str, int des, int buffer, int buffersize, void *ssl_fd)
/*
* Slurp up the data that is available into 'str'.
*/
while (ioe->read_pos < ioe->write_pos)
while (ioe->read_pos < ioe->write_pos && cnt < (buffersize - 1))
{
if (((str[cnt] = ioe->buffer[ioe->read_pos++])) == '\n')
break;
cnt++;
if (cnt >= buffersize-1)
if ((str[cnt++] = ioe->buffer[ioe->read_pos++]) == '\n')
break;
}
/*
* Terminate it
*/
str[cnt + 1] = 0;
str[cnt] = 0;
/*
* If we end in a newline, then all is well.
@ -369,8 +366,8 @@ int BX_dgets (char *str, int des, int buffer, int buffersize, void *ssl_fd)
* The caller then would need to do a strlen() to get
* the amount of data.
*/
if (str[cnt] == '\n')
return cnt;
if (cnt > 0 && str[cnt - 1] == '\n')
return cnt - 1;
else
return 0;
}