Project

General

Profile

Bug #3022

src/common/oml.c/oml_send_msg(): The 'memcpy' function doesn't copy the whole string

Added by fixeria over 1 year ago. Updated 3 months ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
-
Target version:
-
Start date:
03/01/2018
Due date:
% Done:

100%

Spec Reference:

Description

Have a look at the following part of the oml_send_msg():

if (is_manuf) {
/* length byte, string + 0 termination */
uint8_t *manuf = msgb_push(msg, 1 + sizeof(abis_nm_ipa_magic));
manuf0 = strlen(abis_nm_ipa_magic)+1;
memcpy(manuf+1, abis_nm_ipa_magic, strlen(abis_nm_ipa_magic));
}

Here we assuming '\0', but memcpy is used anyway, which does omit '\0'...

History

#1 Updated by laforge 9 months ago

  • Assignee set to fixeria

#2 Updated by fixeria 3 months ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 90

#3 Updated by fixeria 3 months ago

  • Status changed from Feedback to Resolved
  • % Done changed from 90 to 100

Merged.

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)