From 1a21cc70d69d9d8f34d6b1faab1f942f57888585 Mon Sep 17 00:00:00 2001 From: Xiang Wang Date: Wed, 20 Jan 2021 17:31:19 +0800 Subject: helpers.c: Fix undefined behavior in strndup() Using strlen() or strdup() inside strndup() is problematic: if the input string is not null-terminated, these functions can read past the end of the buffer, which triggers undefined behavior. Rewrite the function to never read past the provided `maxlen` bound. Change-Id: Id34127024085879228626fbad59af03268ec5255 Signed-off-by: Xiang Wang Reviewed-on: https://review.coreboot.org/c/flashrom/+/49741 Reviewed-by: Angel Pons Reviewed-by: Edward O'Callaghan Tested-by: build bot (Jenkins) --- helpers.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/helpers.c b/helpers.c index c83cd2cb0..289848d7d 100644 --- a/helpers.c +++ b/helpers.c @@ -106,15 +106,16 @@ char* strtok_r(char *str, const char *delim, char **nextp) /* strndup is a POSIX function not present in MinGW */ char *strndup(const char *src, size_t maxlen) { - if (strlen(src) > maxlen) { - char *retbuf; - if ((retbuf = malloc(1 + maxlen)) != NULL) { - memcpy(retbuf, src, maxlen); - retbuf[maxlen] = '\0'; - } - return retbuf; + char *retbuf; + size_t len; + for (len = 0; len < maxlen; len++) + if (src[len] == '\0') + break; + if ((retbuf = malloc(1 + len)) != NULL) { + memcpy(retbuf, src, len); + retbuf[len] = '\0'; } - return strdup(src); + return retbuf; } #endif -- cgit v1.2.3