From 74d715243cc143af339da21ac38b0ee79e01daf0 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Thu, 18 Mar 2021 10:35:35 +0100 Subject: [PATCH] sanitize(): avoid strlen() to check string for NUL termination The strlen() function can easiliy go out of bounds. Use memchr() instead, we have the max buffer len as argument anyway. Also fix call to sanitize() which used wrong length. Signed-off-by: Joachim Wiberg --- src/svc.c | 2 +- src/util.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/svc.c b/src/svc.c index e9e53ebb..f6dd562d 100644 --- a/src/svc.c +++ b/src/svc.c @@ -617,7 +617,7 @@ int svc_parse_jobstr(char *str, size_t len, int (*found)(svc_t *), int (not_foun char *ptr; _d("Got token:'%s'", input); - token = sanitize(input, len); + token = sanitize(input, strlen(input) + 1); if (!token) { _d("Sanitation of token:'%s' failed", input); goto next; diff --git a/src/util.c b/src/util.c index 691d6b11..ac9b4926 100644 --- a/src/util.c +++ b/src/util.c @@ -193,7 +193,7 @@ char *sanitize(char *arg, size_t len) regex_t preg; int rc; - if (strlen(arg) > len) + if (!memchr(arg, 0, len)) return NULL; if (regcomp(&preg, regex, REG_ICASE | REG_EXTENDED))