mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-11-21 01:16:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

snprintf() made a single-byte buffer overflow, as it could write a zero

Browse Source 
outside its given buffer. Discovered and reported by James Bursa.
This commit is contained in:
Daniel Stenberg 2003-10-26 15:37:45 +00:00
parent 245ab7c796
commit 4cccceb034
1 changed files with 24 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
lib/mprintf.c
View File

@ -961,41 +961,38 @@ static int addbyter(int output, FILE *data)
return -1;
}
int curl_mvsnprintf(char *buffer, size_t maxlength, const char *format,
va_list ap_save)
{
int retcode;
struct nsprintf info;
info.buffer = buffer;
info.length = 0;
info.max = maxlength;
retcode = dprintf_formatf(&info, addbyter, format, ap_save);
if(info.max) {
/* we terminate this with a zero byte */
if(info.max == info.length)
/* we're at maximum, scrap the last letter */
info.buffer[-1] = 0;
else
info.buffer[0] = 0;
}
return retcode;
}
int curl_msnprintf(char *buffer, size_t maxlength, const char *format, ...)
{
int retcode;
va_list ap_save; /* argument pointer */
int retcode;
struct nsprintf info;
info.buffer = buffer;
info.length = 0;
info.max = maxlength;
va_start(ap_save, format);
retcode = dprintf_formatf(&info, addbyter, format, ap_save);
retcode = curl_mvsnprintf(buffer, maxlength, format, ap_save);
va_end(ap_save);
info.buffer[0] = 0; /* we terminate this with a zero byte */
/* we could even return things like */
return retcode;
}
int curl_mvsnprintf(char *buffer, size_t maxlength, const char *format, va_list ap_save)
{
int retcode;
struct nsprintf info;
info.buffer = buffer;
info.length = 0;
info.max = maxlength;
retcode = dprintf_formatf(&info, addbyter, format, ap_save);
info.buffer[0] = 0; /* we terminate this with a zero byte */
return retcode;
}
/* fputc() look-alike */
static int alloc_addbyter(int output, FILE *data)
{