generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3496933 - Out-of-bounds access in CheckOtherHTTPHeaders

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 01:15:34 PST

An out-of-bands access is raised because size of
RespInst->AcceptLanguageHeader is 200 and TmpBuf size is 180.
(cherry picked from commit 69f3fe2330)
This commit is contained in:
Fabrice Fontaine 2012-03-05 11:20:07 +01:00 committed by Marcelo Roberto Jimenez
parent 0eb4101492
commit 078b4cf2c6
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -299,6 +299,15 @@ Version 1.8.0
Version 1.6.16
*******************************************************************************
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3496933 - Out-of-bounds access in CheckOtherHTTPHeaders
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 01:15:34 PST
An out-of-bands access is raised because size of
RespInst->AcceptLanguageHeader is 200 and TmpBuf size is 180.
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
Remove unused currentDevice variable in removeServiceTable

10
upnp/src/genlib/net/http/webserver.c
View File

@ -2,6 +2,7 @@
*
* Copyright (c) 2000-2003 Intel Corporation
* All rights reserved.
* Copyright (c) 2012 France Telecom All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
@ -913,8 +914,13 @@ static int CheckOtherHTTPHeaders(
}
break;
case HDR_ACCEPT_LANGUAGE:
memcpy(RespInstr->AcceptLanguageHeader, TmpBuf,
sizeof(RespInstr->AcceptLanguageHeader) - 1);
if (sizeof(TmpBuf) > sizeof(RespInstr->AcceptLanguageHeader)) {
memcpy(RespInstr->AcceptLanguageHeader, TmpBuf,
sizeof(RespInstr->AcceptLanguageHeader) - 1);
} else {
memcpy(RespInstr->AcceptLanguageHeader, TmpBuf,
sizeof(TmpBuf) - 1);
}
break;
default:
/*