Blame SOURCES/openslp-2.0.0-fortify-source-buffer-overflow.patch

fab3ca
diff -up openslp-2.0.0/slpd/slpd_predicate.c.orig openslp-2.0.0/slpd/slpd_predicate.c
fab3ca
--- openslp-2.0.0/slpd/slpd_predicate.c.orig	2012-12-11 00:31:53.000000000 +0100
fab3ca
+++ openslp-2.0.0/slpd/slpd_predicate.c	2015-01-14 13:17:45.115104003 +0100
fab3ca
@@ -1425,6 +1425,8 @@ void freePredicateParseTree(SLPDPredicat
fab3ca
          break;
fab3ca
       }
fab3ca
       pNextNode = pNode->next;
fab3ca
+      xfree(pNode->nodeBody.comparison.tag_str);
fab3ca
+      xfree(pNode->nodeBody.comparison.value_str);
fab3ca
       xfree(pNode);
fab3ca
       pNode = pNextNode;
fab3ca
    }
fab3ca
@@ -1643,26 +1645,28 @@ SLPDPredicateParseResult createPredicate
fab3ca
       rhs = val_start;
fab3ca
 
fab3ca
       /***** Create leaf node. *****/
fab3ca
-      *ppNode = (SLPDPredicateTreeNode *)xmalloc(sizeof (SLPDPredicateTreeNode) + lhs_len + rhs_len);
fab3ca
+      *ppNode = (SLPDPredicateTreeNode *)xmalloc(sizeof (SLPDPredicateTreeNode));
fab3ca
       if (!(*ppNode))
fab3ca
          return PREDICATE_PARSE_INTERNAL_ERROR;
fab3ca
 
fab3ca
+      (*ppNode)->nodeBody.comparison.tag_str = (char *)xmalloc((lhs_len+1) * sizeof(char));
fab3ca
+      if (!((*ppNode)->nodeBody.comparison.tag_str))
fab3ca
+         return PREDICATE_PARSE_INTERNAL_ERROR;
fab3ca
+
fab3ca
+      (*ppNode)->nodeBody.comparison.value_str = (char *)xmalloc((rhs_len+1) * sizeof(char));
fab3ca
+      if (!((*ppNode)->nodeBody.comparison.value_str))
fab3ca
+         return PREDICATE_PARSE_INTERNAL_ERROR;
fab3ca
+
fab3ca
       (*ppNode)->nodeType = op;
fab3ca
       (*ppNode)->next = (SLPDPredicateTreeNode *)0;
fab3ca
 
fab3ca
-      /* Finished with "operator" now - just use as temporary pointer to assist with copying the
fab3ca
-       * attribute name (lhs) and required value (rhs) into the node
fab3ca
-       */
fab3ca
-      operator = (*ppNode)->nodeBody.comparison.storage;
fab3ca
-      strncpy(operator, lhs, lhs_len);
fab3ca
-      operator[lhs_len] = '\0';
fab3ca
       (*ppNode)->nodeBody.comparison.tag_len = lhs_len;
fab3ca
-      (*ppNode)->nodeBody.comparison.tag_str = operator;
fab3ca
-      operator += lhs_len + 1;
fab3ca
-      strncpy(operator, rhs, rhs_len);
fab3ca
-      operator[rhs_len] = '\0';
fab3ca
+      strncpy((*ppNode)->nodeBody.comparison.tag_str, lhs, lhs_len);
fab3ca
+      (*ppNode)->nodeBody.comparison.tag_str[lhs_len] = '\0';
fab3ca
+
fab3ca
       (*ppNode)->nodeBody.comparison.value_len = rhs_len;
fab3ca
-      (*ppNode)->nodeBody.comparison.value_str = operator;
fab3ca
+      strncpy((*ppNode)->nodeBody.comparison.value_str, rhs, rhs_len);
fab3ca
+      (*ppNode)->nodeBody.comparison.value_str[rhs_len] = '\0';
fab3ca
 
fab3ca
       return PREDICATE_PARSE_OK;
fab3ca
    }