From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 5 Jul 2017 15:27:55 +0000 (-0400)
Subject: FR-AD-001 - (v3) use strncmp() instead of memcmp() for bounded data
X-Git-Tag: release_3_0_15~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=41dfe9f0ca550ceb5f152ba8baf03fd6222d7119;p=thirdparty%2Ffreeradius-server.git

FR-AD-001 - (v3) use strncmp() instead of memcmp() for bounded data
---

diff --git a/src/main/conffile.c b/src/main/conffile.c
index 5f4c7226984..3b634554c57 100644
--- a/src/main/conffile.c
+++ b/src/main/conffile.c
@@ -1199,7 +1199,7 @@ static char const *cf_expand_variables(char const *cf, int *lineno,
 				ERROR("%s[%d]: Reference \"%s\" type is invalid", cf, *lineno, input);
 				return NULL;
 			}
-		} else if (memcmp(ptr, "$ENV{", 5) == 0) {
+		} else if (strncmp(ptr, "$ENV{", 5) == 0) {
 			char *env;
 
 			ptr += 5;