Changeset 3047 for pjproject

Timestamp:

Jan 6, 2010 2:35:13 PM (15 years ago)

Author:

bennylp

Message:

Ticket #1012: Potential buffer overflow in Unicode string conversion (thanks Orville Pike for the report)

Location:

pjproject/trunk/pjlib/src/pj

Files:

• unicode_symbian.cpp (modified) (2 diffs)
• unicode_win32.c (modified) (2 diffs)

pjproject/trunk/pjlib/src/pj/unicode_symbian.cpp

@@ -39 +39 @@
         *wbuf = 0;
     } else {
-        wbuf[len] = 0;
+        if (len < wbuf_count)
+            wbuf[len] = 0;
+        else
+            wbuf[len-1] = 0;
     }
 
@@ -62 +65 @@
         buf[0] = '\0';
     } else {
-        buf[len] = '\0';
+        if (len < buf_size)
+            buf[len] = '\0';
+        else
+            buf[len-1] = '\0';
     }
 

pjproject/trunk/pjlib/src/pj/unicode_win32.c

@@ -31 +31 @@
     len = MultiByteToWideChar(CP_ACP, 0, s, len, 
                               buf, buf_count);
-    buf[len] = 0;
+    if (buf_count) {
+        if (len < buf_count)
+            buf[len] = 0;
+        else
+            buf[len-1] = 0;
+    }
+
     return buf;
 }
@@ -42 +48 @@
 
     len = WideCharToMultiByte(CP_ACP, 0, wstr, len, buf, buf_size, NULL, NULL);
-    buf[len] = '\0';
+    if (buf_size) {
+        if (len < buf_size)
+            buf[len] = '\0';
+        else
+            buf[len-1] = '\0';
+    }
+
     return buf;
 }