From ac0f96efc0b3f3e743db29bff3d4992d034d7976 Mon Sep 17 00:00:00 2001 From: Jacek Jendrzej Date: Tue, 11 Jun 2019 13:12:57 +0200 Subject: [PATCH] luaclient: fix result buffer overflow Origin commit data ------------------ Commit: https://github.com/neutrino-images/ni-neutrino/commit/b568f26b95c13a61a3b81b1691833b88772e56bc Author: Jacek Jendrzej Date: 2019-06-11 (Tue, 11 Jun 2019) --- lib/luaclient/luaclient.cpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/lib/luaclient/luaclient.cpp b/lib/luaclient/luaclient.cpp index 9eb3dd47c..26b5df7c7 100644 --- a/lib/luaclient/luaclient.cpp +++ b/lib/luaclient/luaclient.cpp @@ -76,7 +76,7 @@ int main(int argc, char** argv) int res = -1; const char *fun = NULL; char *resp = NULL; - char result[size]; + char *result = NULL; if (!client.Send(data, size)) { fun = "Send failed"; @@ -86,7 +86,10 @@ int main(int argc, char** argv) fun = "Recv (1) failed"; goto fail; } - if (!client.Recv(result, size)) { + if(size) + result = (char*) malloc(size); + + if (result && !client.Recv(result, size)) { fun = "Recv (2) failed"; goto fail; } @@ -102,8 +105,12 @@ int main(int argc, char** argv) resp += strlen(resp) + 1; if (resp < result + size) fprintf(stderr, "%s", resp); + if(result) + free(result); exit(res); fail: + if(result) + free(result); if (fun) fprintf(stderr, "luaclient: %s.\n", fun); exit(-1);