generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3496933 - Out-of-bounds access in CheckOtherHTTPHeaders

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 01:15:34 PST

An out-of-bands access is raised because size of
RespInst->AcceptLanguageHeader is 200 and TmpBuf size is 180.
This commit is contained in:
Fabrice Fontaine 2012-03-05 11:20:07 +01:00
parent 52df3081df
commit 69f3fe2330
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -2,6 +2,15 @@
Version 1.6.16
*******************************************************************************
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3496933 - Out-of-bounds access in CheckOtherHTTPHeaders
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 01:15:34 PST
An out-of-bands access is raised because size of
RespInst->AcceptLanguageHeader is 200 and TmpBuf size is 180.
2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
Remove unused currentDevice variable in removeServiceTable

10
upnp/src/genlib/net/http/webserver.c
View File

@ -2,6 +2,7 @@
*
* Copyright (c) 2000-2003 Intel Corporation
* All rights reserved.
* Copyright (c) 2012 France Telecom All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
@ -908,8 +909,13 @@ static int CheckOtherHTTPHeaders(
}
break;
case HDR_ACCEPT_LANGUAGE:
memcpy(RespInstr->AcceptLanguageHeader, TmpBuf,
sizeof(RespInstr->AcceptLanguageHeader) - 1);
if (sizeof(TmpBuf) > sizeof(RespInstr->AcceptLanguageHeader)) {
memcpy(RespInstr->AcceptLanguageHeader, TmpBuf,
sizeof(RespInstr->AcceptLanguageHeader) - 1);
} else {
memcpy(RespInstr->AcceptLanguageHeader, TmpBuf,
sizeof(TmpBuf) - 1);
}
break;
default:
/*