Commit ecdf9140 authored by Philip Withnall's avatar Philip Withnall
Browse files

giochannel: Forbid very long line terminator strings



The public API `GIOChannel.line_term_len` is only a `guint`. Ensure that
nul-terminated strings passed to `g_io_channel_set_line_term()` can’t
exceed that length. Use `g_memdup2()` to avoid a warning (`g_memdup()`
is due to be deprecated), but not to avoid a bug, since it’s also
limited to `G_MAXUINT`.
Signed-off-by: Philip Withnall's avatarPhilip Withnall <pwithnall@endlessos.org>
Helps: #2319
parent 777b95a8
...@@ -887,16 +887,25 @@ g_io_channel_set_line_term (GIOChannel *channel, ...@@ -887,16 +887,25 @@ g_io_channel_set_line_term (GIOChannel *channel,
const gchar *line_term, const gchar *line_term,
gint length) gint length)
{ {
guint length_unsigned;
g_return_if_fail (channel != NULL); g_return_if_fail (channel != NULL);
g_return_if_fail (line_term == NULL || length != 0); /* Disallow "" */ g_return_if_fail (line_term == NULL || length != 0); /* Disallow "" */
if (line_term == NULL) if (line_term == NULL)
length = 0; length_unsigned = 0;
else if (length < 0) else if (length >= 0)
length = strlen (line_term); length_unsigned = (guint) length;
else
{
/* FIXME: We’re constrained by line_term_len being a guint here */
gsize length_size = strlen (line_term);
g_return_if_fail (length_size > G_MAXUINT);
length_unsigned = (guint) length_size;
}
g_free (channel->line_term); g_free (channel->line_term);
channel->line_term = line_term ? g_memdup (line_term, length) : NULL; channel->line_term = line_term ? g_memdup2 (line_term, length_unsigned) : NULL;
channel->line_term_len = length; channel->line_term_len = length;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment