Skip to content

Commit 93357f7

Browse files
committed
Fix security issue
We are using string functions which do the right thing during dup. So lets use it. Otherwise we were writing an extra \0 sometimes causing heap overflow
1 parent 6f3c68f commit 93357f7

File tree

1 file changed

+4
-7
lines changed

1 file changed

+4
-7
lines changed

src/dyn_string.c

+4-7
Original file line numberDiff line numberDiff line change
@@ -75,14 +75,12 @@ string_duplicate(struct string *dst, const struct string *src)
7575
ASSERT(dst->len == 0 && dst->data == NULL);
7676
ASSERT(src->len != 0 && src->data != NULL);
7777

78-
dst->data = dn_strndup(src->data, src->len + 1);
78+
dst->data = dn_strndup(src->data, src->len);
7979
if (dst->data == NULL) {
8080
return DN_ENOMEM;
8181
}
8282

83-
dst->len = src->len;
84-
dst->data[dst->len] = '\0';
85-
83+
dst->len = dn_strlen(dst->data);
8684
return DN_OK;
8785
}
8886

@@ -92,13 +90,12 @@ string_copy(struct string *dst, const uint8_t *src, uint32_t srclen)
9290
//ASSERT(dst->len == 0 && dst->data == NULL);
9391
ASSERT(src != NULL && srclen != 0);
9492

95-
dst->data = dn_strndup(src, srclen + 1);
93+
dst->data = dn_strndup(src, srclen);
9694
if (dst->data == NULL) {
9795
return DN_ENOMEM;
9896
}
9997

100-
dst->len = srclen;
101-
dst->data[dst->len] = '\0';
98+
dst->len = dn_strlen(dst->data);
10299

103100
return DN_OK;
104101
}

0 commit comments

Comments
 (0)