]> git.ipfire.org Git - thirdparty/curl.git/commitdiff
lib547, 555: fix off-by-one null-terminator in read callback
authorViktor Szakats <commit@vsz.me>
Tue, 23 Dec 2025 11:03:10 +0000 (12:03 +0100)
committerViktor Szakats <commit@vsz.me>
Tue, 23 Dec 2025 18:49:59 +0000 (19:49 +0100)
`strcpy()` wrote an unnecessary null-terminator past the available read
buffer.

test551 was also affected because it reuses lib547.

Cherry-picked from #20076
Closes #20082

tests/libtest/lib547.c
tests/libtest/lib555.c

index cafb845f70aca77bc21fc3c4d191f63dd181f38d..6611bdeaecba29ad7a683f68c631d2a23680b940 100644 (file)
@@ -44,7 +44,7 @@ static size_t t547_read_cb(char *ptr, size_t size, size_t nmemb, void *clientp)
 
   if(size * nmemb >= T547_DATALEN) {
     curl_mfprintf(stderr, "READ!\n");
-    strcpy(ptr, t547_uploadthis);
+    memcpy(ptr, t547_uploadthis, T547_DATALEN);
     return T547_DATALEN;
   }
   curl_mfprintf(stderr, "READ NOT FINE!\n");
index b0573b7f1a90da06258190c30ac5c5b4e3597fce..883b73b5bb5d48541dffc4a6f2dcf03b2d28b562 100644 (file)
@@ -48,7 +48,7 @@ static size_t t555_read_cb(char *ptr, size_t size, size_t nmemb, void *clientp)
 
   if(size * nmemb >= T555_DATALEN) {
     curl_mfprintf(stderr, "READ!\n");
-    strcpy(ptr, t555_uploadthis);
+    memcpy(ptr, t555_uploadthis, T555_DATALEN);
     return T555_DATALEN;
   }
   curl_mfprintf(stderr, "READ NOT FINE!\n");