okseby/Quake-III-Arena
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ensure that mbstowcs does not overflow its buffer

Browse source 
Similar to one of the changes by Tim Angus in fd986da: mbstowcs' third
argument is the number of wchar_t available in dest, not the number
of bytes.

This does not appear to be exploitable, because ioquake3 does
not actually call mumble_set_identity() or mumble_set_description()
anywhere, but it might be relevant to derivatives.

Spotted via compiler warnings.
This commit is contained in:
Simon McVittie 2015-01-04 11:08:20 +00:00
parent 8469c40c2b
commit ff7ff32b0e
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
code/client/libmumblelink.c
View file

@ -146,7 +146,7 @@ void mumble_set_identity(const char* identity)
size_t len; size_t len;
if (!lm) if (!lm)
return; return;
len = MIN(sizeof(lm->identity), strlen(identity)+1); len = MIN(sizeof(lm->identity)/sizeof(wchar_t), strlen(identity)+1);
mbstowcs(lm->identity, identity, len); mbstowcs(lm->identity, identity, len);
} }
@ -164,7 +164,7 @@ void mumble_set_description(const char* description)
size_t len; size_t len;
if (!lm) if (!lm)
return; return;
len = MIN(sizeof(lm->description), strlen(description)+1); len = MIN(sizeof(lm->description)/sizeof(wchar_t), strlen(description)+1);
mbstowcs(lm->description, description, len); mbstowcs(lm->description, description, len);
} }