Skip to content

Commit

Permalink
Fix interface class/name buffer over-read.
Browse files Browse the repository at this point in the history
Class was mallocing 10 bytes, then GetString would do a strncpy
of 10 bytes into class, however strncpy was not null-terminating
the buffer. From the strncpy man page:

  Warning: If there is no null byte among the first n bytes of
    src, the string placed in dest will not be null-terminated.

Fix is to malloc an extra byte for the class and name buffers.

Signed-off-by: Michael Sartain <mikesart@gmail.com>
  • Loading branch information
mikesartain committed Sep 15, 2016
1 parent 301d412 commit bef1aac
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions usbparse.c
Original file line number Diff line number Diff line change
Expand Up @@ -416,8 +416,8 @@ static void AddInterface (Device *device, char *data)

interface = (DeviceInterface *)g_malloc0 (sizeof(DeviceInterface));

interface->class = (gchar *)g_malloc0 ((INTERFACE_CLASS_SIZE) * sizeof(gchar));
interface->name = (gchar *)g_malloc0 ((INTERFACE_DRIVERNAME_STRING_MAXLENGTH) * sizeof(gchar));
interface->class = (gchar *)g_malloc0 ((INTERFACE_CLASS_SIZE + 1) * sizeof(gchar));
interface->name = (gchar *)g_malloc0 ((INTERFACE_DRIVERNAME_STRING_MAXLENGTH + 1) * sizeof(gchar));

interface->interfaceNumber = GetInt (data, INTERFACE_NUMBER_STRING, 10);
interface->alternateNumber = GetInt (data, INTERFACE_ALTERNATESETTING_STRING, 10);
Expand Down

0 comments on commit bef1aac

Please sign in to comment.