libburnia/libisoburn
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prevented a possible buffer overrun with -concat. Coverity CID 28782.

Browse Source
This commit is contained in:
Thomas Schmitt
2015-11-05 12:08:24 +00:00
parent 7ff4fbe02f
commit 410320c002
3 changed files with 25 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
xorriso/opts_a_c.c
View File

@ -2235,6 +2235,7 @@ int Xorriso_option_concat(struct XorrisO *xorriso,
{
int ret, end_idx, optc= 0, progc= 0, iso_rr_start, prog_end_idx= -1;
char **optv= NULL, **progv= NULL, *delimiter_mem= NULL;
char *delimiter= NULL;
/* Must be done before any goto ex; */
end_idx= Xorriso_end_idx(xorriso, argc, argv, *idx, 1);
@ -2260,9 +2261,16 @@ int Xorriso_option_concat(struct XorrisO *xorriso,
ret= 0; goto ex;
}
ret= Xorriso_check_thing_len(xorriso, argv[*idx + 1],
sizeof(xorriso->list_delimiter), "-concat",
"Delimiter", 0);
if(ret <= 0)
goto ex;
Xorriso_alloc_meM(delimiter_mem, char, strlen(xorriso->list_delimiter) + 1);
Xorriso_alloc_meM(delimiter, char, strlen(argv[*idx + 1]) + 1);
strcpy(delimiter_mem, xorriso->list_delimiter);
strcpy(xorriso->list_delimiter, argv[*idx + 1]);
strcpy(delimiter, argv[*idx + 1]);
strcpy(xorriso->list_delimiter, delimiter);
ret= Xorriso_opt_args(xorriso, "-concat pipe", argc , argv, *idx + 2,
&prog_end_idx, &progc, &progv, 4 | 128);
strcpy(xorriso->list_delimiter, delimiter_mem);
@ -2288,15 +2296,16 @@ int Xorriso_option_concat(struct XorrisO *xorriso,
progc, progv, optc, optv, 0);
ex:;
if(progv != NULL) {
if(delimiter_mem != NULL)
strcpy(xorriso->list_delimiter, argv[*idx + 2]);
if(delimiter_mem != NULL && delimiter != NULL)
strcpy(xorriso->list_delimiter, delimiter);
Xorriso_opt_args(xorriso, "-concat", argc, argv, *idx + 2, &prog_end_idx,
&progc, &progv, 256);
if(delimiter_mem != NULL)
if(delimiter_mem != NULL && delimiter != NULL)
strcpy(xorriso->list_delimiter, delimiter_mem);
}
Xorriso_opt_args(xorriso, "-concat", argc, argv, iso_rr_start, &end_idx,
&optc, &optv, 256);
Xorriso_free_meM(delimiter);
Xorriso_free_meM(delimiter_mem);
*idx= end_idx;
return(ret);