From: Wes C. <wes...@us...> - 2008-08-27 20:03:06
|
Update of /cvsroot/libsnet/libsnet In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv29132 Modified Files: snet.c Log Message: fixed strcpy of extraneous null termination (heap corruption) Index: snet.c =================================================================== RCS file: /cvsroot/libsnet/libsnet/snet.c,v retrieving revision 1.55 retrieving revision 1.56 diff -C2 -d -r1.55 -r1.56 *** snet.c 1 Aug 2008 19:58:24 -0000 1.55 --- snet.c 27 Aug 2008 20:03:02 -0000 1.56 *************** *** 117,121 **** int fd; ! fd = sn->sn_fd; free( sn->sn_wbuf ); free( sn->sn_rbuf ); --- 117,121 ---- int fd; ! fd = snet_fd( sn ); free( sn->sn_wbuf ); free( sn->sn_rbuf ); *************** *** 158,162 **** return( -1 ); } ! if (( rc = SSL_set_fd( sn->sn_ssl, sn->sn_fd )) != 1 ) { return( rc ); } --- 158,162 ---- return( -1 ); } ! if (( rc = SSL_set_fd( sn->sn_ssl, snet_fd( sn ))) != 1 ) { return( rc ); } *************** *** 275,280 **** len = strlen( p ); SNET_WBUFGROW( len ); ! strcpy( cur, p ); ! cur += strlen( p ); break; --- 275,280 ---- len = strlen( p ); SNET_WBUFGROW( len ); ! memcpy( cur, p, len ); ! cur += len; break; *************** *** 346,350 **** len = p - dbufoff; SNET_WBUFGROW( len ); ! strncpy( cur, dbufoff, len ); cur += len; break; --- 346,350 ---- len = p - dbufoff; SNET_WBUFGROW( len ); ! memcpy( cur, dbufoff, len ); cur += len; break; *************** *** 375,379 **** len = p - dbufoff; SNET_WBUFGROW( len ); ! strncpy( cur, dbufoff, len ); cur += len; break; --- 375,379 ---- len = p - dbufoff; SNET_WBUFGROW( len ); ! memcpy( cur, dbufoff, len ); cur += len; break; *************** *** 405,409 **** len = p - dbufoff; SNET_WBUFGROW( len ); ! strncpy( cur, dbufoff, len ); cur += len; break; --- 405,409 ---- len = p - dbufoff; SNET_WBUFGROW( len ); ! memcpy( cur, dbufoff, len ); cur += len; break; *************** *** 435,439 **** len = p - dbufoff; SNET_WBUFGROW( len ); ! strncpy( cur, dbufoff, len ); cur += len; break; --- 435,439 ---- len = p - dbufoff; SNET_WBUFGROW( len ); ! memcpy( cur, dbufoff, len ); cur += len; break; |