Attachment 705583 Details for Bug 918227 – ZifStore: don't use the passed text as a string

[patch] ZifStore: don't use the passed text as a string

0001-ZifStore-don-t-use-the-passed-text-as-a-string.patch (text/plain), 1.70 KB, created by Giovanni Campagna on 2013-03-05 18:20:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Giovanni Campagna

Created: 2013-03-05 18:20:14 UTC

Size: 1.70 KB

patch

obsolete

>From 09dcac7d4206c455628f45e6bdafa75127ec5254 Mon Sep 17 00:00:00 2001
>From: Giovanni Campagna <gcampagna@src.gnome.org>
>Date: Tue, 5 Mar 2013 19:00:31 +0100
>Subject: [PATCH] ZifStore: don't use the passed text as a string
>
>The text argument to GMarkupParser function is not null terminated,
>assuming it is causes memory corruption and crashes.
>---
> libzif/zif-store-remote.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
>diff --git a/libzif/zif-store-remote.c b/libzif/zif-store-remote.c
>index 97f66cc..bc1126e 100644
>--- a/libzif/zif-store-remote.c
>+++ b/libzif/zif-store-remote.c
>@@ -375,7 +375,7 @@ zif_store_remote_parser_end_element (GMarkupParseContext *context, const gchar *
>  * zif_store_remote_parser_text:
>  **/
> static void
>-zif_store_remote_parser_text (GMarkupParseContext *context, const gchar *text, gsize text_len,
>+zif_store_remote_parser_text (GMarkupParseContext *context, const gchar *buffer, gsize buffer_len,
> 			      gpointer user_data, GError **error)
> 
> {
>@@ -383,6 +383,7 @@ zif_store_remote_parser_text (GMarkupParseContext *context, const gchar *text, g
> 	guint64 timestamp;
> 	ZifMd *md;
> 	ZifStoreRemote *store = user_data;
>+	gchar *text;
> 
> 	if (store->priv->parser_type == ZIF_MD_KIND_UNKNOWN)
> 		return;
>@@ -392,6 +393,8 @@ zif_store_remote_parser_text (GMarkupParseContext *context, const gchar *text, g
> 	if (md == NULL)
> 		return;
> 
>+	text = g_strndup (buffer, buffer_len);
>+
> 	if (store->priv->parser_section == ZIF_STORE_REMOTE_PARSER_SECTION_CHECKSUM) {
> 		g_debug ("setting checksum %s on %s [%s]",
> 			 text,
>@@ -425,6 +428,8 @@ zif_store_remote_parser_text (GMarkupParseContext *context, const gchar *text, g
> 		goto out;
> 	}
> out:
>+
>+	g_free (text);
> 	return;
> }
> 
>-- 
>1.8.1.2
>

Actions: View | Diff

Attachments on bug 918227: 705583