When is debuginfod_query_server is given an hexadecimal string as
build-id build_id_len will be zero. We were checking the size of
the build_id_bytes destination string instead of the string length
of build_id input string. Make sure the input string is not too
big or strcpy might overwrite then end of the build_id_bytes array.
Signed-off-by: Mark Wielaard <m...@klomp.org>
---
debuginfod/ChangeLog | 5 +++++
debuginfod/debuginfod-client.c | 2 +-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/debuginfod/ChangeLog b/debuginfod/ChangeLog
index 9ff2e111..d6bbfac8 100644
--- a/debuginfod/ChangeLog
+++ b/debuginfod/ChangeLog
@@ -1,3 +1,8 @@
+2020-06-16 Mark Wielaard <m...@klomp.org>
+
+ * debuginfod-client.c (debuginfod_query_server): Replace sizeof
+ build_id_bytes check with strlen build_id check.
+
2020-06-16 Mark Wielaard <m...@klomp.org>
* debuginfod-client.c (debuginfod_query_server): Increase suffix
diff --git a/debuginfod/debuginfod-client.c b/debuginfod/debuginfod-client.c
index e9c2ca83..7b53cb31 100644
--- a/debuginfod/debuginfod-client.c
+++ b/debuginfod/debuginfod-client.c
@@ -496,7 +496,7 @@ debuginfod_query_server (debuginfod_client *c,
/* Copy lowercase hex representation of build_id into buf. */
if ((build_id_len >= MAX_BUILD_ID_BYTES) ||
(build_id_len == 0 &&
- sizeof(build_id_bytes) > MAX_BUILD_ID_BYTES*2 + 1))
+ strlen ((const char *) build_id) > MAX_BUILD_ID_BYTES*2))
return -EINVAL;
if (build_id_len == 0) /* expect clean hexadecimal */
strcpy (build_id_bytes, (const char *) build_id);
--
2.18.4
