ITS#8752 (maybe related)

Avoid incremental access to user-supplied bv in dupbv
This commit is contained in:
Howard Chu 2018-12-05 10:41:47 +00:00
parent 932edf8f43
commit 7e5c9c1345

View file

@ -482,7 +482,7 @@ struct berval *
ber_dupbv_x(
struct berval *dst, struct berval *src, void *ctx )
{
struct berval *new;
struct berval *new, tmp;
if( src == NULL ) {
ber_errno = LBER_ERROR_PARAM;
@ -490,7 +490,7 @@ ber_dupbv_x(
}
if ( dst ) {
new = dst;
new = &tmp;
} else {
if(( new = ber_memalloc_x( sizeof(struct berval), ctx )) == NULL ) {
return NULL;
@ -500,19 +500,24 @@ ber_dupbv_x(
if ( src->bv_val == NULL ) {
new->bv_val = NULL;
new->bv_len = 0;
return new;
} else {
if(( new->bv_val = ber_memalloc_x( src->bv_len + 1, ctx )) == NULL ) {
if ( !dst )
ber_memfree_x( new, ctx );
return NULL;
}
AC_MEMCPY( new->bv_val, src->bv_val, src->bv_len );
new->bv_val[src->bv_len] = '\0';
new->bv_len = src->bv_len;
}
if(( new->bv_val = ber_memalloc_x( src->bv_len + 1, ctx )) == NULL ) {
if ( !dst )
ber_memfree_x( new, ctx );
return NULL;
if ( dst ) {
*dst = *new;
new = dst;
}
AC_MEMCPY( new->bv_val, src->bv_val, src->bv_len );
new->bv_val[src->bv_len] = '\0';
new->bv_len = src->bv_len;
return new;
}