From f44b1eb4447085cff350bcd89dbcd080347b91f8 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 29 Nov 2013 17:42:11 +0100 Subject: [PATCH] stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated Otherwise a malicious user could send an unterminated string to cause unterminated reads. --- src/libcharon/plugins/stroke/stroke_socket.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/libcharon/plugins/stroke/stroke_socket.c b/src/libcharon/plugins/stroke/stroke_socket.c index 8c0f2ea7b6..1f6ef6bf14 100644 --- a/src/libcharon/plugins/stroke/stroke_socket.c +++ b/src/libcharon/plugins/stroke/stroke_socket.c @@ -623,8 +623,8 @@ static bool on_accept(private_stroke_socket_t *this, stream_t *stream) return FALSE; } - /* read message */ - msg = malloc(len); + /* read message (we need an additional byte to terminate the buffer) */ + msg = malloc(len + 1); msg->length = len; if (!stream->read_all(stream, (char*)msg + sizeof(len), len - sizeof(len))) { @@ -635,6 +635,9 @@ static bool on_accept(private_stroke_socket_t *this, stream_t *stream) free(msg); return FALSE; } + /* make sure even incorrectly unterminated strings don't extend over the + * message boundaries */ + ((char*)msg)[len] = '\0'; DBG3(DBG_CFG, "stroke message %b", (void*)msg, len); -- 2.47.2