[PATCH] WINGs: make wstrconcat bounds-safe

[Rodolfo García Peñas (kix)]

wstrconcat concatenated str1 and str2 with raw strcpy, so a result longer

than the allocated buffer (or a caller passing a wrong size) could

overflow. Copy with wstrlcpy/wstrlcat and return NULL on truncation,

matching the bounds-safe version that used to live in the awmaker fork

(Tamas TEVESZ, awmaker commit 14863cd3).

---

 WINGs/string.c | 7 +++++--

 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/WINGs/string.c b/WINGs/string.c

index 393f2887..d9d85086 100644

--- a/WINGs/string.c

+++ b/WINGs/string.c

@@ -216,8 +216,11 @@ char *wstrconcat(const char *str1, const char *str2)

        slen1 = strlen(str1);

        slen = slen1 + strlen(str2) + 1;

        str = wmalloc(slen);

-       strcpy(str, str1);

-       strcpy(str + slen1, str2);

+       if (wstrlcpy(str, str1, slen) >= slen ||

+           wstrlcat(str, str2, slen) >= slen) {

+               wfree(str);

+               return NULL;

+       }

 

        return str;

 }

--

2.50.1 (Apple Git-155)

[Christophe]

Not willing to complain, but this is useless.

It is obvious from reading the function that it allocates the right amount of memory.



----- Rodolfo García Peñas (kix) <k...@kix.es> a écrit :

> --
> You received this message because you are subscribed to the Google Groups "Window Maker Development" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to wmaker-dev+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/wmaker-dev/9Ghp2q7fATt2dF-00s4GKiRRXIoyWjdVo1k_s88OhcSAShbfAW2YCigruyl38FEoFsEh-ZcS5J5vITJFEY9VAfhEiV1bSv4gihjr0J8d4tA%3D%40kix.es.