MonetDB: Jul2012 - Fix potential buffer overrun.

[Sjoerd Mullender]

Changeset: 796d3791ad2e for MonetDB
URL: http://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=796d3791ad2e
Modified Files:
        common/utils/msabaoth.c
Branch: Jul2012
Log Message:

Fix potential buffer overrun.
Found by Coverity.
Assume len = strlen(l->val) equals 1023 (i.e. equal to avail).  Then
avail -= len + 1 causes overflow and avail becomes huge.


diffs (12 lines):

diff --git a/common/utils/msabaoth.c b/common/utils/msabaoth.c
--- a/common/utils/msabaoth.c
+++ b/common/utils/msabaoth.c
@@ -880,7 +880,7 @@ msab_serialise(char **ret, const sabdb *
        avail = sizeof(conns) - 1;
        for (l = db->conns; l != NULL; l = l->next) {
                len = strlen(l->val);
-               if (len > avail)
+               if (len >= avail)
                        break;
                memcpy(p, l->val, len);
                p += len + 1;
_______________________________________________
Checkin-list mailing list
Checkin-list@monetdb.org
http://mail.monetdb.org/mailman/listinfo/checkin-list