mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-01-06 10:46:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

ITS#6215: Fix buffer overrun and write through NULL pointer

Browse Source
This commit is contained in:
Hallvard Furuseth 2009-07-29 14:57:09 +00:00
parent 8a0284cf04
commit 12a6f3e055
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libraries/liblber/io.c
View File

@ -129,9 +129,13 @@ ber_realloc( BerElement *ber, ber_len_t len )
char *oldbuf;
assert( ber != NULL );
assert( len > 0 );
assert( LBER_VALID( ber ) );
/* leave room for ber_flatten() to \0-terminate ber_buf */
if ( ++len == 0 ) {
return( -1 );
}
total = ber_pvt_ber_total( ber );
#define LBER_EXBUFSIZ 4060 /* a few words less than 2^N for binary buddy */
@ -415,10 +419,13 @@ int ber_flatten2(
return -1;
}
AC_MEMCPY( bv->bv_val, ber->ber_buf, len );
} else {
bv->bv_val[len] = '\0';
} else if ( ber->ber_buf != NULL ) {
bv->bv_val = ber->ber_buf;
bv->bv_val[len] = '\0';
} else {
bv->bv_val = "";
}
bv->bv_val[len] = '\0';
bv->bv_len = len;
}
return 0;