#106 Heap corruption while loading database

[Andrey Glebov]

While investigating a heap corruption I was running my application with sanitizers and found that the problem was the folowing code:

char* p = (char*)malloc(strlen(val));
strcpy(p, val);

It results in heap corruption because strlen returns the length without the null-terminator while strcpy copies the null-terminator.
The simplest fix would be to change the allocation code to:

char* p = (char*)malloc(strlen(val) + 1);

I've found such code in 2 places in the current master:
1. libs/lensfun/mount.cpp:63 (in void lfMount::AddCompat (const char *val))
2. libs/lensfun/lens.cpp:183 (in void lfLens::AddMount (const char *val))

[seebk]

Thanks for letting us know, it is now fixed in git master.