Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Array out-of-bounds write in raw_read. #7

Open
ghost opened this issue Oct 15, 2012 · 1 comment
Open

Array out-of-bounds write in raw_read. #7

ghost opened this issue Oct 15, 2012 · 1 comment

Comments

@ghost
Copy link

ghost commented Oct 15, 2012

If the raw_read function reads in the full buffer size worth of data then it may append a terminator ('\0') value beyond the end of the allocated buffer region. Below is a copy of the function with one of the original lines commented out and a 'fixed' version of the line afterwards. I just subtracted 1 from the buffer size passed in to ReadFile. I am not sure if this is the best way to handle it or if there are other spots that may have similar problems, but this seems to have fixed the bug I ran across. Thanks.

 static BOOL raw_read (File *this) {
    DWORD bytesRead = 0;
//    BOOL res = ReadFile(lcb_handle(this), lcb_buf(this), lcb_bufsz(this), &bytesRead, NULL);
    BOOL res = ReadFile(lcb_handle(this), lcb_buf(this), lcb_bufsz(this) - 1, &bytesRead, NULL);
    lcb_buf(this)[bytesRead] = '\0';
    return res && bytesRead;
  }
@stevedonovan
Copy link
Owner

Classic out-by-one C char array problem ;) Thanks for the report!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant