From 4b6fe372c68d1ff50e7c161cffadeb298734f49c Mon Sep 17 00:00:00 2001 From: paulhsia Date: Sat, 30 Nov 2019 03:35:30 +0800 Subject: [PATCH 1/5] ucm: Use strncmp to avoid access-out-of-boundary If the length of the identifier is less than the length of the prefix, access-out-of-boundary will occur in memcmp(). Signed-off-by: paulhsia Signed-off-by: Jaroslav Kysela Upstream-Status: Backport Signed-off-by: Tanu Kaskinen --- src/ucm/main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/ucm/main.c b/src/ucm/main.c index b0b6ffb3..252e50d9 100644 --- a/src/ucm/main.c +++ b/src/ucm/main.c @@ -61,11 +61,13 @@ static int check_identifier(const char *identifier, const char *prefix) { int len; - if (strcmp(identifier, prefix) == 0) - return 1; len = strlen(prefix); - if (memcmp(identifier, prefix, len) == 0 && identifier[len] == '/') + if (strncmp(identifier, prefix, len) != 0) + return 0; + + if (identifier[len] == 0 || identifier[len] == '/') return 1; + return 0; } -- 2.20.1