Browse Source

fix potential read past end of buffer in getnameinfo service name lookup

if the loop stopped due to reaching the end of the string, the
subsequent increment could possibly move the position one past the end
of the buffer. no further writes happen, the reads cannot fault anyway
unless the stack completely lacks any zero bytes, and reading junk
should not yield an incorrect result from the function either.
nonetheless the code was wrong and needs to be fixed.
Rich Felker 10 năm trước cách đây
mục cha
commit
633183b5d1
1 tập tin đã thay đổi với 1 bổ sung1 xóa
  1. 1 1
      src/network/getnameinfo.c

+ 1 - 1
src/network/getnameinfo.c

@@ -96,7 +96,7 @@ static void reverse_services(char *buf, int port, int dgram)
 		if ((p=strchr(line, '#'))) *p++='\n', *p=0;
 
 		for (p=line; *p && !isspace(*p); p++);
-		if (!p) continue;
+		if (!*p) continue;
 		*p++ = 0;
 		svport = strtoul(p, &z, 10);