[OPEN-ILS-DEV] PATCH: utils.h (OSRF_BUFFER_ADD_CHAR)

[Scott McKellar]

This patch fixes a bug in the OSRF_BUFFER_ADD_CHAR macro.

Like the corresponding buffer_add_char function, this macro appends a
specified character to a growing_buffer.  Unlike the function, however, the
existing version of the macro does not also append a terminal nul.

This bug had gone unnoticed because, most of the time, the rest of the 
buffer is already filled with nuls, left over from the initial creation of 
the growing_buffer.  I stumbled across the problem when, in the course of
writing a test harness for some other changes, I called buffer_reset()
in order to reuse an existing growing_buffer instead of destroying and
re-creating it.

With debugging turned on, buffer_reset() fills the buffer with exclamation
points, leaving a nul only in the very last byte.  Later, if we use 
buffer_add() or buffer_fadd() to extend the string stored in the 
growing_buffer, it uses strcat() to append the new characters.  The result 
is a buffer overflow.

Actually buffer_reset() should place a nul in the first byte of the buffer.
Tomorrow I shall submit a patch to that effect.

Scott McKellar
http://home.swbell.net/mck9/ct/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: utils_h_6.patch
Type: text/x-patch
Size: 1088 bytes
Desc: not available
Url : http://libmail.georgialibraries.org/pipermail/open-ils-dev/attachments/20081113/494b1ca2/attachment.bin