luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2024-12-25 15:06:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

giochannel: Forbid very long line terminator strings

Browse Source 
The public API `GIOChannel.line_term_len` is only a `guint`. Ensure that
nul-terminated strings passed to `g_io_channel_set_line_term()` can’t
exceed that length. Use `g_memdup2()` to avoid a warning (`g_memdup()`
is due to be deprecated), but not to avoid a bug, since it’s also
limited to `G_MAXUINT`.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>
Helps: #2319
This commit is contained in:
Philip Withnall 2021-02-04 14:09:40 +00:00
parent a8b204ff9d
commit 0cc11f745e
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
glib/giochannel.c
View File

@ -886,16 +886,25 @@ g_io_channel_set_line_term (GIOChannel *channel,
const gchar *line_term,
gint length)
{
guint length_unsigned;
g_return_if_fail (channel != NULL);
g_return_if_fail (line_term == NULL || length != 0); /* Disallow "" */
if (line_term == NULL)
length = 0;
else if (length < 0)
length = strlen (line_term);
length_unsigned = 0;
else if (length >= 0)
length_unsigned = (guint) length;
else
{
/* FIXME: We’re constrained by line_term_len being a guint here */
gsize length_size = strlen (line_term);
g_return_if_fail (length_size > G_MAXUINT);
length_unsigned = (guint) length_size;
}
g_free (channel->line_term);
channel->line_term = line_term ? g_memdup (line_term, length) : NULL;
channel->line_term = line_term ? g_memdup2 (line_term, length_unsigned) : NULL;
channel->line_term_len = length;
}