From: Markus Heidelberg <markus.heidelberg@web.de>
Date: Wed, 08 Apr 2009 22:58:42 GMT
Subject: Re: [PATCH] Fix buffer overflow in config parser
Message-ID: <200904090058.42751.markus.heidelberg@web.de>
In-Reply-To: <49DD21A0.3040505@intra2net.com>

Thomas Jarosch, 09.04.2009:
> Hello together,
> 
> attached is a small patch to fix a buffer overflow in config.c.
> Patch is against git master's HEAD.
> 
> I didn't send this one inline as I wanted to
> preserve the 1024+ byte long line.

You could send the patch inline and attach the example config.

> diff --git a/config.c b/config.c
> index b76fe4c..a9c67e8 100644
> --- a/config.c
> +++ b/config.c
> @@ -72,7 +72,7 @@ static char *parse_value(void)
>                         }
>                 }
>                 if (space) {
> -                       if (len)
> +                       if (len && len < sizeof(value)-1)
>                                 value[len++] = ' ';
>                         space = 0;
>                 }

At the beginning of the for loop, there is already an overflow guard.

		if (len >= sizeof(value))
			return NULL;

It would probably be better to fix it at this place.

		if (len >= sizeof(value)-1)
			return NULL;

Markus