Commit e82ae8b6 authored by Simon Morlat's avatar Simon Morlat
Browse files

fix possible buffer overflow in ortp_strndup()

parent d42e64bf
......@@ -170,7 +170,7 @@ int ortp_file_exist(const char *pathname) {
char *ortp_strndup(const char *str,int n){
int min=MIN((int)strlen(str),n)+1;
char *ret=(char*)ortp_malloc(min);
strncpy(ret,str,n);
strncpy(ret,str,min);
ret[min-1]='\0';
return ret;
}
......@@ -570,16 +570,16 @@ void *ortp_shm_open(unsigned int keyid, int size, int create){
snprintf(name,sizeof(name),"%x",keyid);
if (create){
h = CreateFileMapping(
INVALID_HANDLE_VALUE, // use paging file
NULL, // default security
PAGE_READWRITE, // read/write access
0, // maximum object size (high-order DWORD)
size, // maximum object size (low-order DWORD)
h = CreateFileMapping(
INVALID_HANDLE_VALUE, // use paging file
NULL, // default security
PAGE_READWRITE, // read/write access
0, // maximum object size (high-order DWORD)
size, // maximum object size (low-order DWORD)
name); // name of mapping object
}else{
h = OpenFileMapping(
FILE_MAP_ALL_ACCESS, // read/write access
h = OpenFileMapping(
FILE_MAP_ALL_ACCESS, // read/write access
FALSE, // do not inherit the name
name); // name of mapping object
}
......@@ -587,10 +587,10 @@ void *ortp_shm_open(unsigned int keyid, int size, int create){
ortp_error("Fail to open file mapping (create=%i)",create);
return NULL;
}
buf = (LPTSTR) MapViewOfFile(h, // handle to map object
FILE_MAP_ALL_ACCESS, // read/write permission
0,
0,
buf = (LPTSTR) MapViewOfFile(h, // handle to map object
FILE_MAP_ALL_ACCESS, // read/write permission
0,
0,
size);
if (buf!=NULL){
MapInfo *i=(MapInfo*)ortp_new(MapInfo,1);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment