]> git.ipfire.org Git - thirdparty/systemd.git/commit
strxcpyx: don't overflow dest on strpcpyf truncate
authorVito Caputo <vcaputo@pengaru.com>
Sun, 2 Jul 2017 09:01:59 +0000 (02:01 -0700)
committerVito Caputo <vcaputo@pengaru.com>
Mon, 3 Jul 2017 13:45:53 +0000 (06:45 -0700)
commit9e5bd85a5fc5d80cc8706d2b8bac520f2c6a8149
tree111b794c7c98ad40e9339ffb50ec166c5d1c1e11
parent74d8f1c55b5aa46d2745fa4a74ae9fced6a3cab8
strxcpyx: don't overflow dest on strpcpyf truncate

When vsnprintf() truncated output, dest was advanced by the entire
size of dest leaving it just past the end.  Then the fall-through \0
termination scribbled one past the end.  The explicit null termination
is not necessary since vsnprintf() always includes the terminator even
when truncated.

Additionally these functions encourage calling with zero-length sizes,
while assuming non-zero sizes with potential buffer overflows.

Simply short-circuit the relevant functions when size == 0.

Fixes https://github.com/systemd/systemd/issues/6252
src/basic/strxcpyx.c