Skip to content

Commit 05cd9ea

Browse files
committed
Fixed TrioParse and trio_length limts.
CVE-2020-4030 thanks to @antonio-morales for finding this.
1 parent b8beb55 commit 05cd9ea

File tree

2 files changed

+5
-4
lines changed

2 files changed

+5
-4
lines changed

Diff for: winpr/libwinpr/utils/trio/trio.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -2729,7 +2729,7 @@ TRIO_PRIVATE void TrioWriteString TRIO_ARGS5((self, string, flags, width, precis
27292729
trio_class_t* self, TRIO_CONST char* string,
27302730
trio_flags_t flags, int width, int precision)
27312731
{
2732-
int length;
2732+
int length = 0;
27332733
int ch;
27342734

27352735
assert(VALID(self));
@@ -2747,7 +2747,7 @@ TRIO_PRIVATE void TrioWriteString TRIO_ARGS5((self, string, flags, width, precis
27472747
}
27482748
else
27492749
{
2750-
if (precision == 0)
2750+
if (precision <= 0)
27512751
{
27522752
length = trio_length(string);
27532753
}
@@ -4754,7 +4754,7 @@ TRIO_PUBLIC trio_pointer_t trio_register TRIO_ARGS2((callback, name), trio_callb
47544754
}
47554755

47564756
/* Bail out if namespace is too long */
4757-
if (trio_length(name) >= MAX_USER_NAME)
4757+
if (trio_length_max(name, MAX_USER_NAME) >= MAX_USER_NAME)
47584758
return NULL;
47594759

47604760
/* Bail out if namespace already is registered */

Diff for: winpr/libwinpr/utils/trio/triostr.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
#include <assert.h>
2626
#include <stdlib.h>
2727
#include <string.h>
28+
#include <limits.h>
2829
#include <ctype.h>
2930
#include "triodef.h"
3031
#include "triostr.h"
@@ -328,7 +329,7 @@ TRIO_PUBLIC_STRING void trio_destroy TRIO_ARGS1((string), char* string)
328329

329330
TRIO_PUBLIC_STRING size_t trio_length TRIO_ARGS1((string), TRIO_CONST char* string)
330331
{
331-
return strlen(string);
332+
return trio_length_max(string, INT_MAX);
332333
}
333334

334335
#endif

0 commit comments

Comments
 (0)