From 8cfcf9980a3a7037a12a3052c38e4981cb0f0190 Mon Sep 17 00:00:00 2001 From: Florian Zumbiehl Date: Tue, 1 Sep 2009 12:54:21 +0200 Subject: [PATCH] udev_util_encode_string(): fix possible buffer overflow --- libudev/libudev-util.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/libudev/libudev-util.c b/libudev/libudev-util.c index 38cfd7d0e..9a656b5a9 100644 --- a/libudev/libudev-util.c +++ b/libudev/libudev-util.c @@ -448,28 +448,33 @@ int udev_util_encode_string(const char *str, char *str_enc, size_t len) { size_t i, j; - if (str == NULL || str_enc == NULL || len == 0) + if (str == NULL || str_enc == NULL) return -1; - str_enc[0] = '\0'; for (i = 0, j = 0; str[i] != '\0'; i++) { int seqlen; seqlen = utf8_encoded_valid_unichar(&str[i]); if (seqlen > 1) { + if (len-j < (size_t)seqlen) + goto err; memcpy(&str_enc[j], &str[i], seqlen); j += seqlen; i += (seqlen-1); } else if (str[i] == '\\' || !is_whitelisted(str[i], NULL)) { + if (len-j < 4) + goto err; sprintf(&str_enc[j], "\\x%02x", (unsigned char) str[i]); j += 4; } else { + if (len-j < 1) + goto err; str_enc[j] = str[i]; j++; } - if (j+3 >= len) - goto err; } + if (len-j < 1) + goto err; str_enc[j] = '\0'; return 0; err: -- 2.30.2