From: Michael Brown Date: Thu, 12 Feb 2009 09:16:53 +0000 (+0000) Subject: [settings] Handle errors in fetchf_uristring() X-Git-Tag: v0.9.7~47 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4e6b62c94627d1e05aa986f66054df5f841fe53b;p=thirdparty%2Fipxe.git [settings] Handle errors in fetchf_uristring() fetchf_uristring() was failing to handle error values from fetch_setting(), resulting in its attempting to allocate extremely large temporary buffers on the stack (and so overrunning the stack and locking up the machine). Problem reported by Shao Miller . --- diff --git a/src/core/settings.c b/src/core/settings.c index 2c886fdf6..29e56b32c 100644 --- a/src/core/settings.c +++ b/src/core/settings.c @@ -825,12 +825,15 @@ static int storef_uristring ( struct settings *settings, static int fetchf_uristring ( struct settings *settings, struct setting *setting, char *buf, size_t len ) { - size_t raw_len; + ssize_t raw_len; /* We need to always retrieve the full raw string to know the * length of the encoded string. */ raw_len = fetch_setting ( settings, setting, NULL, 0 ); + if ( raw_len < 0 ) + return raw_len; + { char raw_buf[ raw_len + 1 ];