Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nb_name_len does not increase size when nn_scope contains only a \0,

Browse Source 
do the same on nb_name_encode to avoid a buffer overflow
This commit is contained in:
stacktic 2013-12-15 21:48:55 +00:00
parent e9f2eda43c
commit 55facafc5a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dist/smbfs/lib/smb/nb_name.c vendored
View File

@ -33,7 +33,7 @@
*/
#include <sys/cdefs.h>
__RCSID("$NetBSD: nb_name.c,v 1.6 2013/12/15 21:45:07 stacktic Exp $");
__RCSID("$NetBSD: nb_name.c,v 1.7 2013/12/15 21:48:55 stacktic Exp $");
#include <sys/param.h>
#include <sys/socket.h>
@ -183,7 +183,7 @@ nb_name_encode(struct nb_name *np, u_char *dst)
cp += 2;
}
*cp = 0;
if (np->nn_scope == NULL)
if (np->nn_scope == NULL || *np->nn_scope == 0)
return nb_encname_len(dst);
plen = cp++;
lblen = 0;