abc/lwip
1
0
Fork 0
mirror of https://git.savannah.nongnu.org/git/lwip.git synced 2025-08-06 22:44:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

smtp.c, smtp_set_server_addr: Avoid smtp_server buffer overrun when server name length is SMTP_MAX_SERVERNAME_LEN -> "smtp_server[len] = 0" is an out-of-bound access

Browse Source
This commit is contained in:
Dirk Ziegelmeier 2017-06-14 12:40:58 +02:00
parent 4af438916a
commit 3611b583f5
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/apps/smtp/smtp.c
View File

@ -65,7 +65,7 @@
#include "lwip/altcp_tcp.h" #include "lwip/altcp_tcp.h"
#include "lwip/altcp_tls.h" #include "lwip/altcp_tls.h"
#include <string.h> #include <string.h> /* strnlen, memcpy */
#include <stdlib.h> #include <stdlib.h>
/** TCP poll interval. Unit is 0.5 sec. */ /** TCP poll interval. Unit is 0.5 sec. */
@ -346,10 +346,10 @@ smtp_set_server_addr(const char* server)
{ {
size_t len = 0; size_t len = 0;
if (server != NULL) { if (server != NULL) {
len = strlen(server); len = strnlen(server, SMTP_MAX_SERVERNAME_LEN); /* strnlen: length WITHOUT terminating 0 byte */
} }
if (len > SMTP_MAX_SERVERNAME_LEN) { if (len >= SMTP_MAX_SERVERNAME_LEN) {
return ERR_MEM; return ERR_MEM; /* too long or no room for terminating 0 byte */
} }
if (len != 0) { if (len != 0) {
MEMCPY(smtp_server, server, len); MEMCPY(smtp_server, server, len);

2
src/include/lwip/apps/smtp_opts.h
View File

@ -24,7 +24,7 @@ extern "C" {
#define SMTP_DEBUG LWIP_DBG_OFF #define SMTP_DEBUG LWIP_DBG_OFF
#endif #endif
/** Maximum length reserved for server name */ /** Maximum length reserved for server name including terminating 0 byte */
#ifndef SMTP_MAX_SERVERNAME_LEN #ifndef SMTP_MAX_SERVERNAME_LEN
#define SMTP_MAX_SERVERNAME_LEN 256 #define SMTP_MAX_SERVERNAME_LEN 256
#endif #endif