clamav/clamav-0.88.1-strncpy.patch

27 lines
969 B
Diff
Raw Normal View History

2006-04-24 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
* libclamav/unrarlib.c/stricomp(): terminate the string copied
with strncpy() explicitly with '\0'. Does not seem to be
exploitable at the moment due to deeply buried constraints
(function will be called for buffers with a static size of
260 only).
But it is better to fix it now than to run into problems
when function is used for other purposes.
--- clamav-0.88.1/libclamav/unrarlib.c.strncpy 2005-06-23 22:03:12.000000000 +0200
+++ clamav-0.88.1/libclamav/unrarlib.c 2006-04-24 23:10:07.000000000 +0200
@@ -1180,8 +1180,10 @@ int stricomp(char *Str1,char *Str2)
char S1[512],S2[512];
char *chptr;
- strncpy(S1,Str1,sizeof(S1));
- strncpy(S2,Str2,sizeof(S2));
+ strncpy(S1,Str1,sizeof(S1));
+ strncpy(S2,Str2,sizeof(S2));
+ S1[sizeof(S1)-1] = '\0';
+ S2[sizeof(S2)-1] = '\0';
while((chptr = strchr(S1, '\\')) != NULL) /* ignore backslash */
{