From bef4260ad58bc9eb75e2e1a52ad9b49bc3c70fa5 Mon Sep 17 00:00:00 2001 From: Havoc Pennington Date: Wed, 31 Oct 2007 13:58:28 -0400 Subject: Fix a problem where a nul byte was wrongly introduced into UUIDs, due to _dbus_string_copy_to_buffer weird behavior. 2007-10-31 Havoc Pennington * bus/selinux.c (log_audit_callback): rewrite to use _dbus_string_copy_to_buffer_with_nul() * dbus/dbus-string.c (_dbus_string_copy_to_buffer): change to NOT nul-terminate the buffer; fail an assertion if there is not enough space in the target buffer. This fixes two bugs where copy_to_buffer was used to copy the binary bytes in a UUID, where nul termination did not make sense. Bug reported by David Castelow. (_dbus_string_copy_to_buffer_with_nul): new function that always nul-terminates the buffer, and fails an assertion if there is not enough space in the buffer. --- bus/selinux.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'bus/selinux.c') diff --git a/bus/selinux.c b/bus/selinux.c index 735a76d4..d31f9386 100644 --- a/bus/selinux.c +++ b/bus/selinux.c @@ -178,7 +178,20 @@ static void log_audit_callback (void *data, security_class_t class, char *buf, size_t bufleft) { DBusString *audmsg = data; - _dbus_string_copy_to_buffer (audmsg, buf, bufleft); + + if (bufleft > (size_t) _dbus_string_get_length(audmsg)) + { + _dbus_string_copy_to_buffer_with_nul (audmsg, buf, bufleft); + } + else + { + DBusString s; + + _dbus_string_init_const(&s, "Buffer too small for audit message"); + + if (bufleft > (size_t) _dbus_string_get_length(&s)) + _dbus_string_copy_to_buffer_with_nul (&s, buf, bufleft); + } } /** -- cgit