summaryrefslogtreecommitdiffstats
path: root/firmware
diff options
context:
space:
mode:
authorWilliam Wilgus <me.theuser@yahoo.com>2018-11-06 12:33:38 -0500
committerWilliam Wilgus <me.theuser@yahoo.com>2018-11-10 02:47:19 +0100
commitde6618a2713ef26f888762cbe6539cc65a393c7c (patch)
tree82d4a6ff2c9292568beb0925d4e6f98de1f4d5f6 /firmware
parentfa8760705c3685a31a119c58b348364410433952 (diff)
downloadrockbox-de6618a2713ef26f888762cbe6539cc65a393c7c.tar.gz
rockbox-de6618a2713ef26f888762cbe6539cc65a393c7c.tar.bz2
rockbox-de6618a2713ef26f888762cbe6539cc65a393c7c.zip
Fix vuprintf fix possible %s buffer over-read
when precision is not specified memchr recieved -1 for count count is unsigned so it looks in a potentially very large area for a terminator and returns this whole area if \0 is not found Instead we should use memchr when precision is specified and if precision is not specified use strlen Fixes 60+Mb Config.cfg files Change-Id: Ic4d1439334588f999c9071235430c42df2af5cc4
Diffstat (limited to 'firmware')
-rw-r--r--firmware/common/vuprintf.c19
1 files changed, 12 insertions, 7 deletions
diff --git a/firmware/common/vuprintf.c b/firmware/common/vuprintf.c
index 152dc93299..7dd9449e56 100644
--- a/firmware/common/vuprintf.c
+++ b/firmware/common/vuprintf.c
@@ -473,15 +473,20 @@ static inline const char * format_s(const void *str,
return NULL; /* wchar_t support for now */
}
+ const char *s = str;
+ size_t len;
/* string length may be specified by precision instead of \0-
terminated; however, don't go past a \0 if one is there */
- const char *s = str;
- size_t len = precision >= 0 ? precision : -1;
-
- const char *nil = memchr(s, '\0', len);
- if (nil) {
- len = nil - s;
- }
+ if (precision >= 0) {
+ const char *nil = memchr(s, '\0', (size_t) precision);
+
+ if (nil != NULL && (nil - s) < precision)
+ len = nil - s;
+ else
+ len = precision;
+ }
+ else
+ len = strlen(s);
fmt_buf->length = len;
return s;