[Pkg-telepathy-commits] [libnice] 29/265: agent: Avoid memcpy()ing garbage between username strings

[Simon McVittie]

This is an automated email from the git hooks/post-receive script.

smcv pushed a commit to branch debian
in repository libnice.

commit 64d3f1885f3fcdf7c74a3f638b0f86cab4437116
Author: Philip Withnall <philip.withnall at collabora.co.uk>
Date:   Tue Dec 17 09:38:07 2013 +0000

    agent: Avoid memcpy()ing garbage between username strings
    
    If (username_len > uname_len), memcpy() would fall off the end of the
    uname string and copy (username_len - uname_len) bytes of garbage into
    username.
    
    Theoretical bug: not actually attempted to be demonstrated in the wild.
---
 agent/conncheck.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/agent/conncheck.c b/agent/conncheck.c
index 20aac34..245fcb4 100644
--- a/agent/conncheck.c
+++ b/agent/conncheck.c
@@ -2929,7 +2929,7 @@ gboolean conn_check_handle_inbound_stun (NiceAgent *agent, Stream *stream,
 	  uname_len = priv_create_username (agent, stream,
               component->id,  remote_candidate2, local_candidate,
 	      uname, sizeof (uname), FALSE);
-	  memcpy (username, uname, username_len);
+	  memcpy (username, uname, MIN (uname_len, username_len));
 
 	  req.key = g_base64_decode ((gchar *) remote_candidate2->password,
               &req.key_len);

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-telepathy/libnice.git