morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-15 08:54:38 +09:00
Code Issues Packages Projects Releases Wiki Activity

Fixed TrioParse and trio_length limts.

Browse Source 
CVE-2020-4030 thanks to @antonio-morales for finding this.
This commit is contained in:
akallabeth
2020-05-26 16:12:58 +02:00
committed by Armin Novak
parent b8beb55913
commit 05cd9ea229
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
winpr/libwinpr/utils/trio/trio.c
View File

@@ -2729,7 +2729,7 @@ TRIO_PRIVATE void TrioWriteString TRIO_ARGS5((self, string, flags, width, precis
trio_class_t* self, TRIO_CONST char* string,
trio_flags_t flags, int width, int precision)
{
int length;
int length = 0;
int ch;
assert(VALID(self));
@@ -2747,7 +2747,7 @@ TRIO_PRIVATE void TrioWriteString TRIO_ARGS5((self, string, flags, width, precis
}
else
{
if (precision == 0)
if (precision <= 0)
{
length = trio_length(string);
}
@@ -4754,7 +4754,7 @@ TRIO_PUBLIC trio_pointer_t trio_register TRIO_ARGS2((callback, name), trio_callb
}
/* Bail out if namespace is too long */
if (trio_length(name) >= MAX_USER_NAME)
if (trio_length_max(name, MAX_USER_NAME) >= MAX_USER_NAME)
return NULL;
/* Bail out if namespace already is registered */

3
winpr/libwinpr/utils/trio/triostr.c
View File

@@ -25,6 +25,7 @@
#include <assert.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>
#include <ctype.h>
#include "triodef.h"
#include "triostr.h"
@@ -328,7 +329,7 @@ TRIO_PUBLIC_STRING void trio_destroy TRIO_ARGS1((string), char* string)
TRIO_PUBLIC_STRING size_t trio_length TRIO_ARGS1((string), TRIO_CONST char* string)
{
return strlen(string);
return trio_length_max(string, INT_MAX);
}
#endif