Blame SOURCES/openslp-2.0.0-fortify-source-buffer-overflow.patch

3caeb8
diff -up openslp-2.0.0/slpd/slpd_predicate.c.orig openslp-2.0.0/slpd/slpd_predicate.c
3caeb8
--- openslp-2.0.0/slpd/slpd_predicate.c.orig	2012-12-11 00:31:53.000000000 +0100
3caeb8
+++ openslp-2.0.0/slpd/slpd_predicate.c	2015-01-14 13:17:45.115104003 +0100
3caeb8
@@ -1425,6 +1425,8 @@ void freePredicateParseTree(SLPDPredicat
3caeb8
          break;
3caeb8
       }
3caeb8
       pNextNode = pNode->next;
3caeb8
+      xfree(pNode->nodeBody.comparison.tag_str);
3caeb8
+      xfree(pNode->nodeBody.comparison.value_str);
3caeb8
       xfree(pNode);
3caeb8
       pNode = pNextNode;
3caeb8
    }
3caeb8
@@ -1643,26 +1645,28 @@ SLPDPredicateParseResult createPredicate
3caeb8
       rhs = val_start;
3caeb8
 
3caeb8
       /***** Create leaf node. *****/
3caeb8
-      *ppNode = (SLPDPredicateTreeNode *)xmalloc(sizeof (SLPDPredicateTreeNode) + lhs_len + rhs_len);
3caeb8
+      *ppNode = (SLPDPredicateTreeNode *)xmalloc(sizeof (SLPDPredicateTreeNode));
3caeb8
       if (!(*ppNode))
3caeb8
          return PREDICATE_PARSE_INTERNAL_ERROR;
3caeb8
 
3caeb8
+      (*ppNode)->nodeBody.comparison.tag_str = (char *)xmalloc((lhs_len+1) * sizeof(char));
3caeb8
+      if (!((*ppNode)->nodeBody.comparison.tag_str))
3caeb8
+         return PREDICATE_PARSE_INTERNAL_ERROR;
3caeb8
+
3caeb8
+      (*ppNode)->nodeBody.comparison.value_str = (char *)xmalloc((rhs_len+1) * sizeof(char));
3caeb8
+      if (!((*ppNode)->nodeBody.comparison.value_str))
3caeb8
+         return PREDICATE_PARSE_INTERNAL_ERROR;
3caeb8
+
3caeb8
       (*ppNode)->nodeType = op;
3caeb8
       (*ppNode)->next = (SLPDPredicateTreeNode *)0;
3caeb8
 
3caeb8
-      /* Finished with "operator" now - just use as temporary pointer to assist with copying the
3caeb8
-       * attribute name (lhs) and required value (rhs) into the node
3caeb8
-       */
3caeb8
-      operator = (*ppNode)->nodeBody.comparison.storage;
3caeb8
-      strncpy(operator, lhs, lhs_len);
3caeb8
-      operator[lhs_len] = '\0';
3caeb8
       (*ppNode)->nodeBody.comparison.tag_len = lhs_len;
3caeb8
-      (*ppNode)->nodeBody.comparison.tag_str = operator;
3caeb8
-      operator += lhs_len + 1;
3caeb8
-      strncpy(operator, rhs, rhs_len);
3caeb8
-      operator[rhs_len] = '\0';
3caeb8
+      strncpy((*ppNode)->nodeBody.comparison.tag_str, lhs, lhs_len);
3caeb8
+      (*ppNode)->nodeBody.comparison.tag_str[lhs_len] = '\0';
3caeb8
+
3caeb8
       (*ppNode)->nodeBody.comparison.value_len = rhs_len;
3caeb8
-      (*ppNode)->nodeBody.comparison.value_str = operator;
3caeb8
+      strncpy((*ppNode)->nodeBody.comparison.value_str, rhs, rhs_len);
3caeb8
+      (*ppNode)->nodeBody.comparison.value_str[rhs_len] = '\0';
3caeb8
 
3caeb8
       return PREDICATE_PARSE_OK;
3caeb8
    }