shithub: choc

Download patch

ref: d03ee98d63748ba0e2225be221b45a250c8c5741
parent: b34294b67473e8d3ad4b8204327e03d91bcd6214
author: Fabian Greffrath <fabian@greffrath.com>
date: Fri Mar 27 12:26:22 EDT 2015

Avoid calling strlen() on a potentially unterminated string

The src string may be unterminated and the call to strncpy() be
terminated by reaching dest_size. Instead of calling strlen() on the
src string, check if it has a NUL byte at the same position as the
dest string -- if not, the string was truncated.

Valgrind now gives thumbs up!

--- a/src/m_misc.c

+++ b/src/m_misc.c

@@ -372,12 +372,15 @@

 boolean M_StringCopy(char *dest, const char *src, size_t dest_size)

 {

+    size_t len;

+

     if (dest_size >= 1)

     {

         dest[dest_size - 1] = '\0';

         strncpy(dest, src, dest_size - 1);

     }

-    return strlen(dest) == strlen(src);

+    len = strlen(dest);

+    return src[len] == '\0';

 }

 // Safe string concat function that works like OpenBSD's strlcat().