Skip to content

Commit

Permalink
repodata_schema2id: fix heap-buffer-overflow in memcmp
Browse files Browse the repository at this point in the history
When the length of last schema in data->schemadata is
less than length of input schema, we got a read overflow
in asan test.

Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
  • Loading branch information
haoren3696 committed Aug 6, 2019
1 parent 9bb2290 commit fdb9c9c
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions src/repodata.c
Original file line number Diff line number Diff line change
Expand Up @@ -211,11 +211,13 @@ repodata_schema2id(Repodata *data, Id *schema, int create)
cid = schematahash[h];
if (cid)
{
if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
if ((data->schemata[cid] + len <= data->schemadatalen) &&
!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
return cid;
/* cache conflict, do a slow search */
for (cid = 1; cid < data->nschemata; cid++)
if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
if ((data->schemata[cid] + len <= data->schemadatalen) &&
!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
return cid;
}
/* a new one */
Expand Down

0 comments on commit fdb9c9c

Please sign in to comment.