Re: [PATCH] Fix buffer overflow in config parser

From: Thomas Jarosch <thomas.jarosch@intra2net.com>
Date: Apr 9, 2009, 07:59 UTC
Message-ID: <200904090959.28646.thomas.jarosch@intra2net.com>
In-Reply-To: <200904090115.17609.markus.heidelberg@web.de>

On Thursday, 9. April 2009 01:15:17 Markus Heidelberg wrote:

Show 15 quoted lines

> > > diff --git a/config.c b/config.c
> > > index b76fe4c..a9c67e8 100644
> > > --- a/config.c
> > > +++ b/config.c
> > > @@ -72,7 +72,7 @@ static char *parse_value(void)
> > >                         }
> > >                 }
> > >                 if (space) {
> > > -                       if (len)
> > > +                       if (len && len < sizeof(value)-1)
> > >                                 value[len++] = ' ';
> > >                         space = 0;
>
> Eh, or maybe better add a "continue;" here, so that only one char per
> loop is read.

Thanks for the review.

If I understand the intention of the complete code correctly, the idea was to read in 1+ spaces and put -one- space in the buffer as soon as the first non-space character is encountered (if not inside quotes).

Adding a "continue" statement would eat up the first non-space character.

I guess it's ok to modify the first size check or keep to problem local and check the size before putting the space in the buffer. Guess that's up to the maintainer which method he prefers.

Cheers, Thomas