diff options
| author | Miloslav Trmač <mitr@redhat.com> | 2012-06-21 13:01:07 +0200 |
|---|---|---|
| committer | Gergely Nagy <algernon@balabit.hu> | 2012-06-22 14:59:16 +0200 |
| commit | 4158df7874fe07ff731d756c9742188ce4d6e8c2 (patch) | |
| tree | a5331572d9685eb867130caf95554ad9c1a2cf80 /lib/buffer.c | |
| parent | 5abbd19f268a1faded0794d63fb4d8141924160f (diff) | |
| download | libumberlog-4158df7874fe07ff731d756c9742188ce4d6e8c2.tar.gz libumberlog-4158df7874fe07ff731d756c9742188ce4d6e8c2.tar.xz libumberlog-4158df7874fe07ff731d756c9742188ce4d6e8c2.zip | |
Fix 1-byte heap overflow in ul_buffer_finalize
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Diffstat (limited to 'lib/buffer.c')
| -rw-r--r-- | lib/buffer.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/buffer.c b/lib/buffer.c index acb813d..93c5295 100644 --- a/lib/buffer.c +++ b/lib/buffer.c @@ -225,11 +225,15 @@ char * ul_buffer_finalize (ul_buffer_t *buffer) { if (buffer->msg[buffer->len - 1] == ',') - buffer->msg[buffer->len - 1] = '}'; - else { if (!_ul_buffer_ensure_size (buffer, buffer->len + 1)) return NULL; + buffer->msg[buffer->len - 1] = '}'; + } + else + { + if (!_ul_buffer_ensure_size (buffer, buffer->len + 2)) + return NULL; buffer->msg[buffer->len++] = '}'; } buffer->msg[buffer->len] = '\0'; |