Project

General

Profile

Bug #3022

src/common/oml.c/oml_send_msg(): The 'memcpy' function doesn't copy the whole string

Added by fixeria about 1 year ago. Updated 6 months ago.

Status:
New
Priority:
Normal
Assignee:
Category:
-
Target version:
-
Start date:
03/01/2018
Due date:
% Done:

0%

Spec Reference:

Description

Have a look at the following part of the oml_send_msg():

if (is_manuf) {
/* length byte, string + 0 termination */
uint8_t *manuf = msgb_push(msg, 1 + sizeof(abis_nm_ipa_magic));
manuf0 = strlen(abis_nm_ipa_magic)+1;
memcpy(manuf+1, abis_nm_ipa_magic, strlen(abis_nm_ipa_magic));
}

Here we assuming '\0', but memcpy is used anyway, which does omit '\0'...

History

#1 Updated by laforge 6 months ago

  • Assignee set to fixeria

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)