LibRaw/fix-stack-buffer-overflow-in-LibRaw_buffer_datastream::gets.patch

51 lines
1.6 KiB
Diff

From e70ded8b0bc231f7ed3fd5d2e83d61bd18ef5e94 Mon Sep 17 00:00:00 2001
From: Alex Tutubalin <lexa@lexa.ru>
Date: Thu, 3 Dec 2020 12:28:52 +0300
Subject: [PATCH] LibRaw_buffer_datastream: gets() not always returns
0-terminated string
Reverted back parse_rollei change
---
src/libraw_datastream.cpp | 7 +++++--
src/metadata/misc_parsers.cpp | 1 -
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/libraw_datastream.cpp b/src/libraw_datastream.cpp
index 606e5de7..eaf071ee 100644
--- a/src/libraw_datastream.cpp
+++ b/src/libraw_datastream.cpp
@@ -422,7 +422,7 @@ char *LibRaw_buffer_datastream::gets(char *s, int sz)
psrc = buf + streampos;
pdest = str;
if(streampos >= streamsize) return NULL;
- while ((size_t(psrc - buf) < streamsize) && ((pdest - str) < sz))
+ while ((size_t(psrc - buf) < streamsize) && ((pdest - str) < (sz-1)))
{
*pdest = *psrc;
if (*psrc == '\n')
@@ -432,8 +432,11 @@ char *LibRaw_buffer_datastream::gets(char *s, int sz)
}
if (size_t(psrc - buf) < streamsize)
psrc++;
- if ((pdest - str) < sz)
+ if ((pdest - str) < sz-1)
*(++pdest) = 0;
+ else
+ s[sz - 1] = 0; // ensure trailing zero
+
streampos = psrc - buf;
return s;
}
diff --git a/src/metadata/misc_parsers.cpp b/src/metadata/misc_parsers.cpp
index 4e36e940..7a74c9f1 100644
--- a/src/metadata/misc_parsers.cpp
+++ b/src/metadata/misc_parsers.cpp
@@ -304,7 +304,6 @@ void LibRaw::parse_rollei()
line[0] = 0;
if (!fgets(line, 128, ifp))
break;
- line[127] = 0;
if(!line[0]) break; // zero-length
if ((val = strchr(line, '=')))
*val++ = 0;