dbus/dbus dbus-marshal-recursive-util.c,1.9,1.10

[John Palmieri]

Update of /cvs/dbus/dbus/dbus
In directory gabe:/tmp/cvs-serv23585/dbus

Modified Files:
	dbus-marshal-recursive-util.c 
Log Message:
* dbus/dbus-marshal-recursive-util.c: Fixed buffer overflow
  in numerous places that did not account for the NULL terminator
  (signature_from_seed): changed the manual string copy loop to
  just use strcpy instead
  make check should now pass



Index: dbus-marshal-recursive-util.c
===================================================================
RCS file: /cvs/dbus/dbus/dbus/dbus-marshal-recursive-util.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -d -r1.9 -r1.10
--- dbus-marshal-recursive-util.c	9 Mar 2005 17:09:11 -0000	1.9
+++ dbus-marshal-recursive-util.c	23 Apr 2005 22:34:48 -0000	1.10
@@ -2458,9 +2458,10 @@
                     DBusTypeWriter *writer,
                     int             seed)
 {
-  char buf[MAX_SAMPLE_STRING_LEN];
+  char buf[MAX_SAMPLE_STRING_LEN + 1]="";
   const char *v_string = buf;
 
+
   string_from_seed (buf, node->klass->subclass_detail,
                     seed);
 
@@ -2475,7 +2476,8 @@
                    int             seed)
 {
   const char *v;
-  char buf[MAX_SAMPLE_STRING_LEN];
+  char buf[MAX_SAMPLE_STRING_LEN + 1];
+  v = buf;
 
   check_expected_type (reader, node->klass->typecode);
 
@@ -2501,7 +2503,7 @@
                   DBusTypeReader *realign_root,
                   int             seed)
 {
-  char buf[MAX_SAMPLE_STRING_LEN];
+  char buf[MAX_SAMPLE_STRING_LEN + 1];
   const char *v_string = buf;
 
   string_from_seed (buf, node->klass->subclass_detail,
@@ -2730,7 +2732,7 @@
                          DBusTypeWriter *writer,
                          int             seed)
 {
-  char buf[MAX_SAMPLE_OBJECT_PATH_LEN];
+  char buf[MAX_SAMPLE_OBJECT_PATH_LEN + 1];
   const char *v_string = buf;
 
   object_path_from_seed (buf, seed);
@@ -2746,7 +2748,7 @@
                         int             seed)
 {
   const char *v;
-  char buf[MAX_SAMPLE_OBJECT_PATH_LEN];
+  char buf[MAX_SAMPLE_OBJECT_PATH_LEN + 1];
 
   check_expected_type (reader, node->klass->typecode);
 
@@ -2771,7 +2773,7 @@
                        DBusTypeReader *realign_root,
                        int             seed)
 {
-  char buf[MAX_SAMPLE_OBJECT_PATH_LEN];
+  char buf[MAX_SAMPLE_OBJECT_PATH_LEN + 1];
   const char *v_string = buf;
 
   object_path_from_seed (buf, seed);
@@ -2786,8 +2788,6 @@
 signature_from_seed (char *buf,
                      int   seed)
 {
-  int i;
-  const char *s;
   /* try to avoid ascending, descending, or alternating length to help find bugs */
   const char *sample_signatures[] = {
     "asax"
@@ -2798,13 +2798,7 @@
     "a(ii)"
   };
 
-  s = sample_signatures[seed % _DBUS_N_ELEMENTS(sample_signatures)];
-
-  for (i = 0; s[i]; i++)
-    {
-      buf[i] = s[i];
-    }
-  buf[i] = '\0';
+  strcpy (buf, sample_signatures[seed % _DBUS_N_ELEMENTS(sample_signatures)]);
 }
 
 static dbus_bool_t
@@ -2813,7 +2807,7 @@
                        DBusTypeWriter *writer,
                        int             seed)
 {
-  char buf[MAX_SAMPLE_SIGNATURE_LEN];
+  char buf[MAX_SAMPLE_SIGNATURE_LEN + 1];
   const char *v_string = buf;
 
   signature_from_seed (buf, seed);
@@ -2829,7 +2823,7 @@
                       int             seed)
 {
   const char *v;
-  char buf[MAX_SAMPLE_SIGNATURE_LEN];
+  char buf[MAX_SAMPLE_SIGNATURE_LEN + 1];
 
   check_expected_type (reader, node->klass->typecode);
 
@@ -2855,7 +2849,7 @@
                      DBusTypeReader *realign_root,
                      int             seed)
 {
-  char buf[MAX_SAMPLE_SIGNATURE_LEN];
+  char buf[MAX_SAMPLE_SIGNATURE_LEN + 1];
   const char *v_string = buf;
 
   signature_from_seed (buf, seed);