Commit 6dba86d7 authored by David Goulet's avatar David Goulet 🐼
Browse files

Merge branch 'maint-0.4.1'

parents 142612bd 1d6054f7

changes/ticket31001

0 → 100644
+6 −0
Original line number Diff line number Diff line 
  o Minor bugfixes (compatibility, standards compliance):

    - Fix a bug that would invoke undefined behavior on certain operating

      systems when trying to asprintf() a string exactly INT_MAX bytes

      long. We don't believe this is exploitable, but it's better

      to fix it anyway. Fixes bug 31001; bugfix on 0.2.2.11-alpha.

      Found and fixed by Tobias Stoeckmann.

src/lib/string/printf.c

+4 −4
Original line number Diff line number Diff line
@@ -117,8 +117,8 @@ tor_vasprintf(char **strp, const char *fmt, va_list args) 
    *strp = NULL;

    return -1;

  }

  strp_tmp = tor_malloc(len + 1);

  r = _vsnprintf(strp_tmp, len+1, fmt, args);

  strp_tmp = tor_malloc((size_t)len + 1);

  r = _vsnprintf(strp_tmp, (size_t)len+1, fmt, args);

  if (r != len) {

    tor_free(strp_tmp);

    *strp = NULL;
@@ -153,9 +153,9 @@ tor_vasprintf(char **strp, const char *fmt, va_list args) 
    *strp = tor_strdup(buf);

    return len;

  }

  strp_tmp = tor_malloc(len+1);

  strp_tmp = tor_malloc((size_t)len+1);

  /* use of tor_vsnprintf() will ensure string is null terminated */

  r = tor_vsnprintf(strp_tmp, len+1, fmt, args);

  r = tor_vsnprintf(strp_tmp, (size_t)len+1, fmt, args);

  if (r != len) {

    tor_free(strp_tmp);

    *strp = NULL;