[devel] [PATCH 1/1] log: fix invalid read [#3325]

[thien.m.huynh]

memcpy copies invalid memory that has not yet been initialized.
So this fix is the correct size when using memcpy.
---
 src/log/logd/lgs_dest.cc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/log/logd/lgs_dest.cc b/src/log/logd/lgs_dest.cc
index 943de15ea..74822c25b 100644
--- a/src/log/logd/lgs_dest.cc
+++ b/src/log/logd/lgs_dest.cc
@@ -199,14 +199,16 @@ void DestinationHandler::FormCfgDestMsg(const 
std::string& dest,
   if (tmp.size() > 1) {
     strncpy(msg->type, tmp[kType].c_str(), kMaxChar - 1);
   }
-  if (tmp.size() == kSize) memcpy(msg->value, tmp[kValue].c_str(), kMaxChar);
+  if (tmp.size() == kSize) {
+    memcpy(msg->value, tmp[kValue].c_str(), tmp[kValue].length() + 1);
+  }
 }
 
 void DestinationHandler::FormDelDestMsg(const std::string& dest,
                                         DelDestMsg* msg) {
   osafassert(msg != nullptr);
   const VectorString tmp = logutil::Parser(dest, kDelimeter);
-  memcpy(msg->name, tmp[kName].c_str(), kMaxChar);
+  memcpy(msg->name, tmp[kName].c_str(), tmp[kName].length() + 1);
 }
 
 bool DestinationHandler::VectorFind(const VectorString& vec,
-- 
2.38.1



_______________________________________________
Opensaf-devel mailing list
Opensaf-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/opensaf-devel