Attachment 7745 Details for Bug 9083 – Patch from master for this issue

[patch] Patch from master for this issue

0001-lib-util-Allocate-enough-space-to-reference-blob-dat.patch (text/plain), 1.16 KB, created by Andrew Bartlett on 2012-08-07 22:01:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2012-08-07 22:01:07 UTC

Size: 1.16 KB

patch

obsolete

>From 1013fab5f82f283335a5d8cbb1bfde8a80d7979c Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Fri, 13 Jul 2012 15:42:08 +1000
>Subject: [PATCH] lib/util: Allocate enough space to reference blob->data[len]
>
>Found by Thomas Hood <jdthood@gmail.com> using valgrind.
>
>Thanks!
>
>Andrew Bartlett
>---
> lib/util/asn1.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/lib/util/asn1.c b/lib/util/asn1.c
>index c23bf65..70637a3 100644
>--- a/lib/util/asn1.c
>+++ b/lib/util/asn1.c
>@@ -844,7 +844,7 @@ bool asn1_read_OctetString(struct asn1_data *data, TALLOC_CTX *mem_ctx, DATA_BLO
> 		return false;
> 	}
> 	*blob = data_blob_talloc(mem_ctx, NULL, len+1);
>-	if (!blob->data) {
>+	if (!blob->data || blob->length < len) {
> 		data->has_error = true;
> 		return false;
> 	}
>@@ -927,8 +927,8 @@ bool asn1_read_BitString(struct asn1_data *data, TALLOC_CTX *mem_ctx, DATA_BLOB
> 	}
> 	if (!asn1_read_uint8(data, padding)) return false;
> 
>-	*blob = data_blob_talloc(mem_ctx, NULL, len);
>-	if (!blob->data) {
>+	*blob = data_blob_talloc(mem_ctx, NULL, len+1);
>+	if (!blob->data || blob->length < len) {
> 		data->has_error = true;
> 		return false;
> 	}
>-- 
>1.7.11.2
>

Actions: View

Attachments on bug 9083: 7745