auracaster/openocd
3
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

server/tcl_server.c: Fix buffer overrun

Browse Source 
The input buffer size is checked only after writing past its end.

Change-Id: I6a9651c5b7d82efe338468d67bf6caca41004b01
Signed-off-by: Jimmy <nhminus@gmail.com>
Reviewed-on: http://openocd.zylin.com/5352
Tested-by: jenkins
Reviewed-by: Tomas Vanek <vanekt@fbl.cz>
This commit is contained in:
Jimmy
2019-12-05 14:45:17 +08:00
committed by Tomas Vanek
parent 1e427fd580
commit 0f12d792ed
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/server/tcl_server.c
View File

@@ -199,7 +199,7 @@ static int tcl_input(struct connection *connection)
for (i = 0; i < rlen; i++) {
/* buffer the data */
tclc->tc_line[tclc->tc_lineoffset] = in[i];
if (tclc->tc_lineoffset < tclc->tc_line_size) {
if (tclc->tc_lineoffset + 1 < tclc->tc_line_size) {
tclc->tc_lineoffset++;
} else if (tclc->tc_line_size >= TCL_LINE_MAX) {
/* maximum line size reached, drop line */