Skip to content

Commit

Permalink
[settings] Handle errors in fetchf_uristring()
Browse files Browse the repository at this point in the history
fetchf_uristring() was failing to handle error values from
fetch_setting(), resulting in its attempting to allocate extremely
large temporary buffers on the stack (and so overrunning the stack and
locking up the machine).

Problem reported by Shao Miller <Shao.Miller@yrdsb.edu.on.ca>.
  • Loading branch information
Michael Brown committed Feb 12, 2009
1 parent 8e960eb commit 4e6b62c
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion src/core/settings.c
Expand Up @@ -825,12 +825,15 @@ static int storef_uristring ( struct settings *settings,
static int fetchf_uristring ( struct settings *settings,
struct setting *setting,
char *buf, size_t len ) {
size_t raw_len;
ssize_t raw_len;

/* We need to always retrieve the full raw string to know the
* length of the encoded string.
*/
raw_len = fetch_setting ( settings, setting, NULL, 0 );
if ( raw_len < 0 )
return raw_len;

{
char raw_buf[ raw_len + 1 ];

Expand Down

0 comments on commit 4e6b62c

Please sign in to comment.