aniani/irssi
1
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2024-12-04 14:46:39 -05:00
Code

Merge branch 'fix-gl8' into 'security'

Browse Source 
Fix oob read of one byte in get_file_params_count

See merge request !12
This commit is contained in:
Nei 2017-05-30 19:38:19 +00:00
commit 84503427b0
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/irc/dcc/dcc-get.c
View File

@ -382,6 +382,8 @@ int get_file_params_count(char **params, int paramcount)
if (*params[0] == '"') { if (*params[0] == '"') {
/* quoted file name? */ /* quoted file name? */
for (pos = 0; pos < paramcount-3; pos++) { for (pos = 0; pos < paramcount-3; pos++) {
if (strlen(params[pos]) == 0)
continue;
if (params[pos][strlen(params[pos])-1] == '"' && if (params[pos][strlen(params[pos])-1] == '"' &&
get_params_match(params, pos+1)) get_params_match(params, pos+1))
return pos+1; return pos+1;

2
src/irc/dcc/dcc-resume.c
View File

@ -62,6 +62,8 @@ int get_file_params_count_resume(char **params, int paramcount)
if (*params[0] == '"') { if (*params[0] == '"') {
/* quoted file name? */ /* quoted file name? */
for (pos = 0; pos < paramcount-2; pos++) { for (pos = 0; pos < paramcount-2; pos++) {
if (strlen(params[pos]) == 0)
continue;
if (params[pos][strlen(params[pos])-1] == '"' && if (params[pos][strlen(params[pos])-1] == '"' &&
get_params_match_resume(params, pos+1)) get_params_match_resume(params, pos+1))
return pos+1; return pos+1;