Explorar el Código

fix bug in newline conversion causing buffer overflows.
this leads to segfaults and has some security impact.

Oswald Buddenhagen hace 19 años
padre
commit
9b657a46a0
Se han modificado 1 ficheros con 8 adiciones y 7 borrados
  1. 8 7
      src/sync.c

+ 8 - 7
src/sync.c

@@ -211,7 +211,7 @@ msg_fetched( int sts, void *aux )
 	copy_vars_t *vars = (copy_vars_t *)aux;
 	SVARS(vars->aux)
 	char *fmap, *buf;
-	int i, len, extra, cra, crd, scr, tcr;
+	int i, len, extra, cra, crd, scr, tcr, crds;
 	int start, sbreak = 0, ebreak = 0;
 	char c;
 
@@ -234,20 +234,21 @@ msg_fetched( int sts, void *aux )
 				extra += 8 + TUIDL + 1 + tcr;
 			  nloop:
 				start = i;
+				crds = 0;
 				while (i < len) {
 					c = fmap[i++];
 					if (c == '\r')
-						extra += crd;
+						crds += crd;
 					else if (c == '\n') {
-						extra += cra;
-						if (i - 1 - scr == start) {
-							sbreak = ebreak = i - 1 - scr;
-							goto oke;
-						}
 						if (!memcmp( fmap + start, "X-TUID: ", 8 )) {
 							extra -= (ebreak = i) - (sbreak = start);
 							goto oke;
 						}
+						extra += cra + crds;
+						if (i - 1 - scr == start) {
+							sbreak = ebreak = i - 1 - scr;
+							goto oke;
+						}
 						goto nloop;
 					}
 				}