[hackers] [libixp] Allocate enough space for terminating nuls when unpacking strings.

changeset: 49:bea83ff874f2
tag: tip
user: Kris Maglione <jg_AT_suckless.org>
date: Sun Mar 18 01:56:09 2007 -0400
summary: Allocate enough space for terminating nuls when unpacking strings.

diff -r 3c5a0bfbc208 -r bea83ff874f2 convert.c
--- a/convert.c Sat Mar 17 18:57:43 2007 -0400
+++ b/convert.c Sun Mar 18 01:56:09 2007 -0400
@@ -100,13 +100,15 @@ ixp_unpack_strings(uchar **msg, int *msi
 
         size = *msize;
         s = *msg;
- for(i=0; i<n; i++) {
+ for(i=0; i<n && size > 0; i++) {
                 ixp_unpack_u16(&s, &size, &len);
                 s += len;
                 size -= len;
         }
- if((size <= 0)
- || (size = *msize - size) == 0) {
+ if(size < 0)
+ size = 0;
+ size = *msize - size + n;
+ if(size <= 0) {
                 /* So we don't try to free some random value */
                 *strings = NULL;
                 return;
Received on Sun Mar 18 2007 - 07:00:32 UTC