Mesa (master): egl: check for buffer overflow *before* corrupting our memory

[GitLab Mirror]

Module: Mesa
Branch: master
Commit: aa78b29ebad710d743747bb9b9755b6eea9ed4d2
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=aa78b29ebad710d743747bb9b9755b6eea9ed4d2

Author: Eric Engestrom <eric.engestrom at intel.com>
Date:   Thu Aug 16 15:31:55 2018 +0100

egl: check for buffer overflow *before* corrupting our memory

Signed-off-by: Eric Engestrom <eric.engestrom at intel.com>
Reviewed-by: Emil Velikov <emil.velikov at collabora.com>

---

 src/egl/main/eglapi.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/egl/main/eglapi.c b/src/egl/main/eglapi.c
index 19fae12f5b..5e5048c4d6 100644
--- a/src/egl/main/eglapi.c
+++ b/src/egl/main/eglapi.c
@@ -538,19 +538,30 @@ _eglCreateExtensionsString(_EGLDisplay *dpy)
 static void
 _eglCreateAPIsString(_EGLDisplay *dpy)
 {
+#define addstr(str) \
+   { \
+      const size_t old_len = strlen(dpy->ClientAPIsString); \
+      const size_t add_len = sizeof(str); \
+      const size_t max_len = sizeof(dpy->ClientAPIsString) - 1; \
+      if (old_len + add_len <= max_len) \
+         strcat(dpy->ClientAPIsString, str " "); \
+      else \
+         assert(!"dpy->ClientAPIsString is not large enough"); \
+   }
+
    if (dpy->ClientAPIs & EGL_OPENGL_BIT)
-      strcat(dpy->ClientAPIsString, "OpenGL ");
+      addstr("OpenGL");
 
    if (dpy->ClientAPIs & EGL_OPENGL_ES_BIT ||
        dpy->ClientAPIs & EGL_OPENGL_ES2_BIT ||
        dpy->ClientAPIs & EGL_OPENGL_ES3_BIT_KHR) {
-      strcat(dpy->ClientAPIsString, "OpenGL_ES ");
+      addstr("OpenGL_ES");
    }
 
    if (dpy->ClientAPIs & EGL_OPENVG_BIT)
-      strcat(dpy->ClientAPIsString, "OpenVG ");
+      addstr("OpenVG");
 
-   assert(strlen(dpy->ClientAPIsString) < sizeof(dpy->ClientAPIsString));
+#undef addstr
 }
 
 static void