Thread (5 messages) flat view 5 messages, 3 authors, 2016-06-15
DORMANTno replies

[PATCH 1/2] http-backend: Fix access beyond end of string.

From: Tarmigan Casebolt <hidden>
Date: 2016-06-15 22:47:43
Subsystem: the rest · Maintainer: Linus Torvalds

Found with valgrind while looking for Content-Length corruption in
smart http.

Signed-off-by: Tarmigan Casebolt <redacted>
---
 http-backend.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/http-backend.c b/http-backend.c
index f8ea9d7..ab9433d 100644
--- a/http-backend.c
+++ b/http-backend.c
@@ -634,7 +634,7 @@ int main(int argc, char **argv)
 			cmd = c;
 			cmd_arg = xmalloc(n);
 			strncpy(cmd_arg, dir + out[0].rm_so + 1, n);
-			cmd_arg[n] = '\0';
+			cmd_arg[n-1] = '\0';
 			dir[out[0].rm_so] = 0;
 			break;
 		}
-- 
1.6.5.51.g191f5
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help