]>
Commit | Line | Data |
---|---|---|
70f8787d JR |
1 | --- rpm-5.4.9/rpmio/mire.c.str_nul~ 2012-04-16 05:21:22.000000000 +0200 |
2 | +++ rpm-5.4.9/rpmio/mire.c 2012-05-15 03:20:14.361970779 +0200 | |
3 | @@ -415,11 +415,10 @@ int mireRegexec(miRE mire, const char * | |
4 | break; | |
5 | /* XXX rpmgrep: ensure that the string is NUL terminated. */ | |
6 | if (vallen > 0) { | |
7 | - if (val[vallen] != '\0') { | |
8 | - char * t = strncpy((char *)alloca(vallen+1), val, vallen); | |
9 | - t[vallen] = '\0'; | |
10 | - val = t; | |
11 | - } | |
12 | + /* if (val[vallen] != '\0') might go outside of allocated memory */ | |
13 | + char * t = strncpy(alloca(vallen+1), val, vallen); | |
14 | + t[vallen] = '\0'; | |
15 | + val = t; | |
16 | } else | |
17 | if (vallen == 0) | |
18 | vallen = strlen(val); | |
19 | @@ -466,6 +465,13 @@ int mireRegexec(miRE mire, const char * | |
20 | case RPMMIRE_GLOB: | |
21 | if (mire->pattern == NULL) | |
22 | break; | |
23 | + /* XXX rpmgrep: ensure that the string is NUL terminated. */ | |
24 | + if (vallen > 0) { | |
25 | + /* if (val[vallen] != '\0') might go outside of allocated memory */ | |
26 | + char * t = strncpy(alloca(vallen+1), val, vallen); | |
27 | + t[vallen] = '\0'; | |
28 | + val = t; | |
29 | + } | |
30 | rc = fnmatch(mire->pattern, val, mire->fnflags); | |
31 | switch (rc) { | |
32 | case 0: rc = 0; /*@innerbreak@*/ break; |