After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 764677 - gssdp-client: Fix potential strncpy() buffer overflow
gssdp-client: Fix potential strncpy() buffer overflow
Status: RESOLVED FIXED
Product: gssdp
Classification: Other
Component: General
unspecified
Other All
: Normal normal
: ---
Assigned To: GUPnP Maintainers
GUPnP Maintainers
Depends on:
Blocks:
 
 
Reported: 2016-04-06 11:48 UTC by Philip Withnall
Modified: 2019-02-22 09:29 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
gssdp-client: Fix potential strncpy() buffer overflow (1.35 KB, patch)
2016-04-06 11:48 UTC, Philip Withnall 		committed Details | Review

Description Philip Withnall 2016-04-06 11:48:45 UTC 
This was introduced with commit f81a63fef856180029508268b2c2f6320a99a984 which references bug #653894, but that looks totally unrelated so I’ve opened a new bug for this fix.

This was spotted by Coverity — Jens, you should listen for the Coverity report e-mails. :-)
Comment 1 Philip Withnall 2016-04-06 11:48:49 UTC 
Created attachment 325475 [details] [review]
gssdp-client: Fix potential strncpy() buffer overflow

strncpy() does not append a nul terminator if the input string is at
least as long as the output buffer length — so you must always reserve
space in the output buffer for a nul terminator. The req structure was
previously memset() to zero, so a nul terminator is present in arp_dev
already.

Spotted by Coverity (CID: 143731).
Comment 2 Jens Georg 2016-04-06 14:25:14 UTC 
That would work I I wouldn't have spent the whole day in meetings :)
Comment 3 Philip Withnall 2016-04-07 22:58:34 UTC 
(In reply to Jens Georg from comment #2)
> That would work I I wouldn't have spent the whole day in meetings :)

:-(

Ack or nack on the patch?
Comment 4 Jens Georg 2016-04-08 06:31:03 UTC 
Review of attachment 325475 [details] [review]:

Sorry +1
Comment 5 Philip Withnall 2016-04-08 08:28:55 UTC 
Attachment 325475 [details] pushed as 67769db - gssdp-client: Fix potential strncpy() buffer overflow