gnutls priority string parsing bug fix

Fix priority string parsing (example: "NONE:+MAC-ALL:-SHA1:+SHA1" misses SHA1 and has MD5 twice)

prio_remove doesn't zero the removed element, prio_add (and perhaps
other functions) assumes the list to be zero terminated.

Make prio_remove zero the element at the end, and use the actual length
of the list in prio_add.

Relying on the trailing zero will fail if the list is full, and might
lead to invalid memory accesses as the loop won't stop until it finds
either the algorithm identifier or 0.

diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index d85707e5c4b5b00f1100ae355904312ac97f9044..95bc69647777289fb8f90bb6d95dc0d2ab14acd1 100644 (file)
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -565,6 +565,7 @@ prio_remove (priority_st * priority_list, unsigned int algo)
           priority_list->algorithms--;
           if ((priority_list->algorithms-i) > 0)
             memmove(&priority_list->priority[i], &priority_list->priority[i+1], (priority_list->algorithms-i)*sizeof(priority_list->priority[0]));
+          priority_list->priority[priority_list->algorithms] = 0;
           break;
         }
     }
@@ -575,19 +576,19 @@ prio_remove (priority_st * priority_list, unsigned int algo)
 static void
 prio_add (priority_st * priority_list, unsigned int algo)
 {
-  register int i = 0;
-  while (priority_list->priority[i] != 0)
+  unsigned int i, l = priority_list->algorithms;
+
+  if (l >= MAX_ALGOS)
+    return;                     /* can't add it anyway */
+
+  for (i = 0; i < l; ++i)
     {
       if (algo == priority_list->priority[i])
         return;                 /* if it exists */
-      i++;
     }
 
-  if (i < MAX_ALGOS)
-    {
-      priority_list->priority[i] = algo;
-      priority_list->algorithms++;
-    }
+  priority_list->priority[l] = algo;
+  priority_list->algorithms++;
 
   return;
 }