[PATCH] Check limits before accessing variables

Vratislav Podzimek vpodzime at redhat.com
Wed Jan 29 06:52:23 UTC 2014


On Tue, 2014-01-28 at 16:47 -0800, Brian C. Lane wrote:
> ---
>  libcheckisomd5.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/libcheckisomd5.c b/libcheckisomd5.c
> index a7a9433..79cccac 100644
> --- a/libcheckisomd5.c
> +++ b/libcheckisomd5.c
> @@ -94,7 +94,7 @@ static int parsepvd(int isofd, char *mediasum, int *skipsectors, long long *isos
>              mediasum[32] = '\0';
>              md5fnd = 1;
>              loc += 45;
> -            for (p=buf2+loc; *p != ';' && loc < 512; p++, loc++);
> +            for (p=buf2+loc; loc < 512 && *p != ';'; p++, loc++);
>          } else if (!strncmp(buf2 + loc, "SKIPSECTORS = ", 14)) {
>              char *errptr;
>  
> @@ -103,7 +103,7 @@ static int parsepvd(int isofd, char *mediasum, int *skipsectors, long long *isos
>                  return -1;
>  
>              loc = loc + 14;
> -            for (p=tmpbuf; buf2[loc] != ';' && loc < 512; p++, loc++)
> +            for (p=tmpbuf; loc < 512 && buf2[loc] != ';'; p++, loc++)
>                  *p = buf2[loc];
>  
>              *p = '\0';
> @@ -115,15 +115,15 @@ static int parsepvd(int isofd, char *mediasum, int *skipsectors, long long *isos
>                  skipfnd = 1;
>              }
>  
> -            for (p=buf2+loc; *p != ';' && loc < 512; p++, loc++);
> +            for (p=buf2+loc; loc < 512 && *p != ';'; p++, loc++);
>          } else if (!strncmp(buf2 + loc, "RHLISOSTATUS=1", 14)) {
>              *supported = 1;
>              supportedfnd = 1;
> -            for (p=buf2+loc; *p != ';' && loc < 512; p++, loc++);
> +            for (p=buf2+loc; loc < 512 && *p != ';'; p++, loc++);
>          } else if (!strncmp(buf2 + loc, "RHLISOSTATUS=0", 14)) {
>              *supported = 0;
>              supportedfnd = 1;
> -            for (p=buf2+loc; *p != ';' && loc < 512; p++, loc++);
> +            for (p=buf2+loc; loc < 512 && *p != ';'; p++, loc++);
>          } else if (!strncmp(buf2 + loc, "FRAGMENT SUMS = ", 16)) {
>              /* make sure we dont walk off end */
>              if ((loc + FRAGMENT_SUM_LENGTH) > 511)
> @@ -133,7 +133,7 @@ static int parsepvd(int isofd, char *mediasum, int *skipsectors, long long *isos
>              fragmentsums[FRAGMENT_SUM_LENGTH] = '\0';
>              fragsumfnd = 1;
>              loc += FRAGMENT_SUM_LENGTH + 16;
> -            for (p=buf2+loc; *p != ';' && loc < 512; p++, loc++);
> +            for (p=buf2+loc; loc < 512 && *p != ';'; p++, loc++);
>          } else if (!strncmp(buf2 + loc, "FRAGMENT COUNT = ", 17)) {
>              char *errptr;
>              /* make sure we dont walk off end */
> @@ -141,7 +141,7 @@ static int parsepvd(int isofd, char *mediasum, int *skipsectors, long long *isos
>                  return -1;
>  
>              loc = loc + 17;
> -            for (p=tmpbuf; buf2[loc] != ';' && loc < 512; p++, loc++)
> +            for (p=tmpbuf; loc < 512 && buf2[loc] != ';'; p++, loc++)
>                  *p = buf2[loc];
>  
>              *p = '\0';
> @@ -153,7 +153,7 @@ static int parsepvd(int isofd, char *mediasum, int *skipsectors, long long *isos
>                  fragcntfnd = 1;
>              }
>  
> -            for (p=buf2+loc; *p != ';' && loc < 512; p++, loc++);
> +            for (p=buf2+loc; loc < 512 && *p != ';'; p++, loc++);
>          } else {
>              loc++;
>          }
ACK.

-- 
Vratislav Podzimek

Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic



More information about the anaconda-patches mailing list