Attachment 84738 Details for Bug 30350 – Avoid reading beyond the length of a variable

[patch] Avoid reading beyond the length of a variable

0001-Avoid-reading-beyond-the-length-of-a-variable.patch (text/plain), 1.72 KB, created by Simon McVittie on 2013-08-27 18:20:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simon McVittie

Created: 2013-08-27 18:20:00 UTC

Size: 1.72 KB

patch

obsolete

>From d3bc54a430ed189664b59baaf2fa121121aec771 Mon Sep 17 00:00:00 2001
>From: Simon McVittie <simon.mcvittie@collabora.co.uk>
>Date: Tue, 27 Aug 2013 19:16:42 +0100
>Subject: [PATCH] Avoid reading beyond the length of a variable
>
>Appending &some as DBUS_TYPE_INT64, DBUS_TYPE_UINT64 or DBUS_TYPE_DOUBLE,
>where "some" is an int, reads beyond the bounds of that variable.
>Use a zero-filled DBusBasicValue instead.
>
>Bug: https://bugs.freedesktop.org/show_bug.cgi?id=30350
>---
> dbus/dbus-message-util.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
>diff --git a/dbus/dbus-message-util.c b/dbus/dbus-message-util.c
>index e50d04e..ecfcea5 100644
>--- a/dbus/dbus-message-util.c
>+++ b/dbus/dbus-message-util.c
>@@ -1474,10 +1474,14 @@ _dbus_message_test (const char *test_data_dir)
>   /* Test enumeration of array elements */
>   for (i = strlen (basic_types) - 1; i > 0; i--)
>     {
>+      DBusBasicValue val;
>       int some;
>       char* signature = _dbus_strdup ("?");
>+
>       signature[0] = basic_types[i];
>       s = "SomeThingToSay";
>+      memset (&val, '\0', sizeof (val));
>+
>       message = dbus_message_new_method_call ("de.ende.test",
>         "/de/ende/test", "de.ende.Test", "ArtistName");
>       _dbus_assert (message != NULL);
>@@ -1489,7 +1493,7 @@ _dbus_message_test (const char *test_data_dir)
>           if (basic_types[i] == DBUS_TYPE_STRING)
>             dbus_message_iter_append_basic (&array_iter, DBUS_TYPE_STRING, &s);
>           else
>-            dbus_message_iter_append_basic (&array_iter, basic_types[i], &some);
>+            dbus_message_iter_append_basic (&array_iter, basic_types[i], &val);
>         }
>       dbus_message_iter_close_container (&iter, &array_iter);
>       dbus_message_iter_init (message, &iter);
>-- 
>1.8.4.rc3
>

Actions: View | Splinter Review

Attachments on bug 30350: 38916 | 38917 | 39098 | 39150 | 84731 | 84732 | 84733 | 84738

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.