Skip to content

Commit 6966f61

Browse files
jimpariscarlescufi
authored andcommitted
Fix buffer overflow in _cbor_value_copy_string
The function is documented to only null-terminate when the buffer is big enough to allow it. Both upstream intel/tinycbor and mynewt's version do this correctly.
1 parent 31ae89e commit 6966f61

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

src/cborparser.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1293,6 +1293,7 @@ CborError _cbor_value_copy_string(const CborValue *value, void *buffer,
12931293
size_t *buflen, CborValue *next)
12941294
{
12951295
bool copied_all;
1296+
size_t maxlen = *buflen;
12961297
CborError err = iterate_string_chunks(value, (char*)buffer, buflen, &copied_all, next,
12971298
buffer ? (IterateFunction) value->parser->d->cpy : iterate_noop);
12981299
if (err) {
@@ -1303,7 +1304,7 @@ CborError _cbor_value_copy_string(const CborValue *value, void *buffer,
13031304
return CborErrorOutOfMemory;
13041305
}
13051306

1306-
if (buffer) {
1307+
if (buffer && *buflen < maxlen) {
13071308
*((uint8_t *)buffer + *buflen) = '\0';
13081309
}
13091310

0 commit comments

Comments
 (0)