aniani/elinks
1
0
Fork 0
mirror of https://github.com/rkd77/elinks.git synced 2024-09-29 03:17:53 -04:00
Code

Debian bug 380347: Prevent a buffer overflow in entity_cache.

Browse Source 
[ From commit 341d54151f in ELinks
  0.12.GIT.  --KON ]
This commit is contained in:
Kalle Olavi Niemitalo 2007-05-01 11:23:25 +03:00 committed by Kalle Olavi Niemitalo
parent 61032a627b
commit 14588b9455
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/intl/charsets.c
View File

@ -548,7 +548,17 @@ get_entity_string(const unsigned char *str, const int strlen, int encoding)
end: end:
/* Take care of potential buffer overflow. */ /* Take care of potential buffer overflow. */
if (strlen < sizeof(entity_cache[slen][0].str)) { if (strlen < sizeof(entity_cache[slen][0].str)) {
struct entity_cache *ece = &entity_cache[slen][nb_entity_cache[slen]]; struct entity_cache *ece;
/* Sort entries by hit order. */
if (nb_entity_cache[slen] > 1)
qsort(&entity_cache[slen][0], nb_entity_cache[slen],
sizeof(entity_cache[slen][0]), (void *) hits_cmp);
/* Increment number of cache entries if possible.
* Else, just replace the least used entry. */
if (nb_entity_cache[slen] < ENTITY_CACHE_SIZE) nb_entity_cache[slen]++;
ece = &entity_cache[slen][nb_entity_cache[slen] - 1];
/* Copy new entry to cache. */ /* Copy new entry to cache. */
ece->hits = 1; ece->hits = 1;
@ -558,21 +568,11 @@ end:
memcpy(ece->str, str, strlen); memcpy(ece->str, str, strlen);
ece->str[strlen] = '\0'; ece->str[strlen] = '\0';
/* Increment number of cache entries if possible. */
if (nb_entity_cache[slen] < ENTITY_CACHE_SIZE) nb_entity_cache[slen]++;
#ifdef DEBUG_ENTITY_CACHE #ifdef DEBUG_ENTITY_CACHE
fprintf(stderr, "Added in [%u]: l=%d st='%s'\n", slen, fprintf(stderr, "Added in [%u]: l=%d st='%s'\n", slen,
entity_cache[slen][0].strlen, entity_cache[slen][0].str); entity_cache[slen][0].strlen, entity_cache[slen][0].str);
#endif
/* Sort entries by hit order. */
if (nb_entity_cache[slen] > 1)
qsort(&entity_cache[slen][0], nb_entity_cache[slen],
sizeof(entity_cache[slen][0]), (void *) hits_cmp);
#ifdef DEBUG_ENTITY_CACHE
{ {
unsigned int i; unsigned int i;
@ -583,7 +583,7 @@ end:
entity_cache[slen][i].str); entity_cache[slen][i].str);
fprintf(stderr, "-----------------\n"); fprintf(stderr, "-----------------\n");
} }
#endif #endif /* DEBUG_ENTITY_CACHE */
} }
return result; return result;
} }