summaryrefslogtreecommitdiff
path: root/lib/util
diff options
context:
space:
mode:
authorMichael Adam <obnox@samba.org>2011-10-18 18:10:00 +0200
committerMichael Adam <obnox@samba.org>2011-10-18 22:32:59 +0200
commit47aa9ed82f67758c3b4d9ab46dd8dd65508a10eb (patch)
tree73ae4dad6aceeb60c7eb68308f5864be3e7ae0cb /lib/util
parentcb47890cf2734afff502cf8b95635ebc75bc5974 (diff)
downloadsamba-47aa9ed82f67758c3b4d9ab46dd8dd65508a10eb.tar.gz
samba-47aa9ed82f67758c3b4d9ab46dd8dd65508a10eb.tar.bz2
samba-47aa9ed82f67758c3b4d9ab46dd8dd65508a10eb.zip
lib/util: skip single hex digit at the end of the input sting - fix potential segfault
The second of two digits was read without checking for the length of the input string. For a non-zero-terminated input string, this might have caused a segfault. Autobuild-User: Michael Adam <obnox@samba.org> Autobuild-Date: Tue Oct 18 22:32:59 CEST 2011 on sn-devel-104
Diffstat (limited to 'lib/util')
-rw-r--r--lib/util/util.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/util/util.c b/lib/util/util.c
index 67ac6938a4..133bd0dfb0 100644
--- a/lib/util/util.c
+++ b/lib/util/util.c
@@ -694,6 +694,7 @@ _PUBLIC_ _PURE_ size_t count_chars(const char *s, char c)
* - "0xnn" or "0Xnn" is specially catered for.
* - The first non-hex-digit character (apart from possibly leading "0x"
* finishes the conversion and skips the rest of the input.
+ * - A single hex-digit character at the end of the string is skipped.
*
* valid examples: "0A5D15"; "0x123456"
*/
@@ -710,7 +711,7 @@ _PUBLIC_ size_t strhex_to_str(char *p, size_t p_len, const char *strhex, size_t
i += 2; /* skip two chars */
}
- for (; i < strhex_len && strhex[i] != 0; i++) {
+ for (; i+1 < strhex_len && strhex[i] != 0 && strhex[i+1] != 0; i++) {
p1 = strchr(hexchars, toupper((unsigned char)strhex[i]));
if (p1 == NULL) {
break;