Unverified Commit 7660a7cf authored by teor's avatar teor
Browse files

Merge remote-tracking branch 'tor-github/pr/1178' into maint-0.2.9

parents 511aeba8 97d73db7
o Minor bugfixes (compatibility, standards compliance):
- Fix a bug that would invoke undefined behavior on certain operating
systems when trying to asprintf() a string exactly INT_MAX bytes
long. We don't believe this is exploitable, but it's better
to fix it anyway. Fixes bug 31001; bugfix on 0.2.2.11-alpha.
Found and fixed by Tobias Stoeckmann.
......@@ -542,8 +542,8 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
*strp = NULL;
return -1;
}
strp_tmp = tor_malloc(len + 1);
r = _vsnprintf(strp_tmp, len+1, fmt, args);
strp_tmp = tor_malloc((size_t)len + 1);
r = _vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
if (r != len) {
tor_free(strp_tmp);
*strp = NULL;
......@@ -578,9 +578,9 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
*strp = tor_strdup(buf);
return len;
}
strp_tmp = tor_malloc(len+1);
strp_tmp = tor_malloc((size_t)len+1);
/* use of tor_vsnprintf() will ensure string is null terminated */
r = tor_vsnprintf(strp_tmp, len+1, fmt, args);
r = tor_vsnprintf(strp_tmp, (size_t)len+1, fmt, args);
if (r != len) {
tor_free(strp_tmp);
*strp = NULL;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment