Project

General

Profile

Enhancement #750 » 0016-sanitize-oidentd-handler-fixes.patch

Loïc Gomez, 2022-01-10 19:28

View differences:

src/irc.c
2450 2450
			return;
2451 2451
		}
2452 2452

  
2453
		content = (char *)bip_malloc(stats.st_size + 1);
2453
		// casting to size_t as stat should never return negative size
2454
		content = (char *)bip_malloc((size_t)(stats.st_size + 1));
2454 2455

  
2455
		if (fread(content, (size_t)1, stats.st_size, f) !=
2456
		// validate that content is of stats.st_size size
2457
		if (fread(content, (size_t)1, (size_t)stats.st_size, f) !=
2456 2458
				(size_t)stats.st_size) {
2457
			mylog(LOG_WARN, "Can't read %s fully",
2458
					bip->oidentdpath);
2459
			mylog(LOG_WARN, "Can't read %s fully", bip->oidentdpath);
2459 2460
			free(content);
2460 2461
			goto clean_oidentd;
2461 2462
		}
......
2474 2475
				goto clean_oidentd;
2475 2476
			}
2476 2477

  
2477
			bipend = strstr(bipstart, BIP_OIDENTD_END);
2478

  
2479
			/* data preceeding the tag */
2480
			fwrite(content, 1, bipstart - content, f);
2478
			// data preceeding the tag, bipstart >= content (strstr)
2479
			fwrite(content, (size_t)1, (size_t)(bipstart - content), f);
2481 2480

  
2482
			/* data following the tag, if any */
2483
			if (bipend != NULL)
2484
				fwrite(bipend + BIP_OIDENTD_END_LENGTH, 1,
2485
						stats.st_size -
2486
						(bipend - content) -
2487
						BIP_OIDENTD_END_LENGTH, f);
2488
			else
2481
			bipend = strstr(bipstart, BIP_OIDENTD_END);
2482
			if (bipend == NULL) {
2489 2483
				mylog(LOG_WARN, "No %s mark found in %s",
2490 2484
						BIP_OIDENTD_END,
2491 2485
						bip->oidentdpath);
2486
			} else {
2487
				/* data following the tag
2488
				 * ...........BIP_OIDENTD_START...BIP_OIDENTD_END..............
2489
				 * ^content...^bipstart...........^bipend........^remaining data
2490
				 */
2491
				char *remaining =  bipend + BIP_OIDENTD_END_LENGTH;
2492
				off_t remaining_len = stats.st_size -
2493
					(bipend - content) - (off_t)BIP_OIDENTD_END_LENGTH;
2494
				if (remaining_len < 0) {
2495
					mylog(LOG_ERROR, "oidentd_dump: error parsing %s",
2496
							bip->oidentdpath);
2497
					goto clean_oidentd;
2498
				}	
2499
				fwrite(remaining, (size_t)1, (size_t)remaining_len, f);
2500
			}
2492 2501
		} else {
2493 2502
			/* No previous conf */
2494 2503
			if (stats.st_size != 0 &&
2495
- 
(15-15/24)