mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-12-25 18:14:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

smtp.c, smtp_set_server_addr: Avoid smtp_server buffer overrun when server name length is SMTP_MAX_SERVERNAME_LEN -> "smtp_server[len] = 0" is an out-of-bound access

Browse Source
This commit is contained in:
Dirk Ziegelmeier 2017-06-14 12:40:58 +02:00
parent 4af438916a
commit 3611b583f5
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/apps/smtp/smtp.c
View File

@ -65,7 +65,7 @@
#include "lwip/altcp_tcp.h"
#include "lwip/altcp_tls.h"
#include <string.h>
#include <string.h> /* strnlen, memcpy */
#include <stdlib.h>
/** TCP poll interval. Unit is 0.5 sec. */
@ -346,10 +346,10 @@ smtp_set_server_addr(const char* server)
{
size_t len = 0;
if (server != NULL) {
len = strlen(server);
len = strnlen(server, SMTP_MAX_SERVERNAME_LEN); /* strnlen: length WITHOUT terminating 0 byte */
}
if (len > SMTP_MAX_SERVERNAME_LEN) {
return ERR_MEM;
if (len >= SMTP_MAX_SERVERNAME_LEN) {
return ERR_MEM; /* too long or no room for terminating 0 byte */
}
if (len != 0) {
MEMCPY(smtp_server, server, len);

2
src/include/lwip/apps/smtp_opts.h
View File

@ -24,7 +24,7 @@ extern "C" {
#define SMTP_DEBUG LWIP_DBG_OFF
#endif
/** Maximum length reserved for server name */
/** Maximum length reserved for server name including terminating 0 byte */
#ifndef SMTP_MAX_SERVERNAME_LEN
#define SMTP_MAX_SERVERNAME_LEN 256
#endif