shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-01-28 21:47:38 +03:00
Code

udev_util_encode_string(): fix possible buffer overflow

Browse Source
This commit is contained in:
Florian Zumbiehl 2009-09-01 12:54:21 +02:00 committed by Kay Sievers
parent 0652604912
commit 8cfcf9980a
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libudev/libudev-util.c
View File

@ -448,28 +448,33 @@ int udev_util_encode_string(const char *str, char *str_enc, size_t len)
{ {
size_t i, j; size_t i, j;
if (str == NULL || str_enc == NULL || len == 0) if (str == NULL || str_enc == NULL)
return -1; return -1;
str_enc[0] = '\0';
for (i = 0, j = 0; str[i] != '\0'; i++) { for (i = 0, j = 0; str[i] != '\0'; i++) {
int seqlen; int seqlen;
seqlen = utf8_encoded_valid_unichar(&str[i]); seqlen = utf8_encoded_valid_unichar(&str[i]);
if (seqlen > 1) { if (seqlen > 1) {
if (len-j < (size_t)seqlen)
goto err;
memcpy(&str_enc[j], &str[i], seqlen); memcpy(&str_enc[j], &str[i], seqlen);
j += seqlen; j += seqlen;
i += (seqlen-1); i += (seqlen-1);
} else if (str[i] == '\\' || !is_whitelisted(str[i], NULL)) { } else if (str[i] == '\\' || !is_whitelisted(str[i], NULL)) {
if (len-j < 4)
goto err;
sprintf(&str_enc[j], "\\x%02x", (unsigned char) str[i]); sprintf(&str_enc[j], "\\x%02x", (unsigned char) str[i]);
j += 4; j += 4;
} else { } else {
if (len-j < 1)
goto err;
str_enc[j] = str[i]; str_enc[j] = str[i];
j++; j++;
} }
if (j+3 >= len)
goto err;
} }
if (len-j < 1)
goto err;
str_enc[j] = '\0'; str_enc[j] = '\0';
return 0; return 0;
err: err: