diff options
| author | Havoc Pennington <hp@localhost.localdomain> | 2007-10-31 13:58:28 -0400 |
|---|---|---|
| committer | Havoc Pennington <hp@localhost.localdomain> | 2007-10-31 13:58:28 -0400 |
| commit | bef4260ad58bc9eb75e2e1a52ad9b49bc3c70fa5 (patch) | |
| tree | a1cabf96f8f525936ebdc1ab88100b5598fd397f /bus | |
| parent | 5340b8de0b537380e0c445495300739d75abeb2f (diff) | |
Fix a problem where a nul byte was wrongly introduced into UUIDs, due to _dbus_string_copy_to_buffer weird behavior.
2007-10-31 Havoc Pennington <hp@redhat.com>
* bus/selinux.c (log_audit_callback): rewrite to use
_dbus_string_copy_to_buffer_with_nul()
* dbus/dbus-string.c (_dbus_string_copy_to_buffer): change to NOT
nul-terminate the buffer; fail an assertion if there is not enough
space in the target buffer. This fixes two bugs where
copy_to_buffer was used to copy the binary bytes in a UUID, where
nul termination did not make sense. Bug reported by David Castelow.
(_dbus_string_copy_to_buffer_with_nul): new function that always
nul-terminates the buffer, and fails an assertion if there is not
enough space in the buffer.
Diffstat (limited to 'bus')
| -rw-r--r-- | bus/selinux.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/bus/selinux.c b/bus/selinux.c index 735a76d4..d31f9386 100644 --- a/bus/selinux.c +++ b/bus/selinux.c @@ -178,7 +178,20 @@ static void log_audit_callback (void *data, security_class_t class, char *buf, size_t bufleft) { DBusString *audmsg = data; - _dbus_string_copy_to_buffer (audmsg, buf, bufleft); + + if (bufleft > (size_t) _dbus_string_get_length(audmsg)) + { + _dbus_string_copy_to_buffer_with_nul (audmsg, buf, bufleft); + } + else + { + DBusString s; + + _dbus_string_init_const(&s, "Buffer too small for audit message"); + + if (bufleft > (size_t) _dbus_string_get_length(&s)) + _dbus_string_copy_to_buffer_with_nul (&s, buf, bufleft); + } } /** |