HomeClusterLabs Projects

doxyxml: print_param: fix heap-buffer-overflow on read

Description

doxyxml: print_param: fix heap-buffer-overflow on read

in read_struct we can get the pi->paramtype assigned with:

pi->paramtype = type?strdup(type):strdup("");

And in print_param we then always check the last character by getting
the strlen and subtracting one. But in the case where either type was
NULL and we assigned an empty string, or type wasn't null but
pointing to an empty string we ran into an read-heap-buffer-overflow
as here strlen is zero, and so we the first if branch evaluated to

if (pi->paramtype[-1] == '*') {

which isn't valid. Depending on the OS, protection of surrounding
area due to said OS or the compiler, this can crash the program.

Similar issue was the case for the next check for double pointers,
here for all strings with strlen < 2.

To solve this get the strlen early and check if we cannot underflow
before doing the real read.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

Details

Provenance
Thomas Lamprecht <t.lamprecht@proxmox.com>Authored on Oct 8 2019, 11:09 AM
Parents
rKa0128b93d4a6: Merge pull request #260 from kronosnet/test-suite
Branches
Unknown
Tags
Unknown

Event Timeline