nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-28 14:23:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make sure control command bodies are always followed by a NUL

Browse Source 
svn:r2678
This commit is contained in:
Nick Mathewson 2004-11-04 22:30:49 +00:00
parent 9a06612ff6
commit d9e0f3f9bc
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/or/buffers.c
View File

@ -636,7 +636,16 @@ int fetch_from_buf_socks(buf_t *buf, socks_request_t *req) {
} }
} }
/* DOCDOC: 1 if complete, 0 if pending, -1 on error. */ /** If there is a complete control message waiting on buf, then store
* its contents into *<b>type_out</b>, store its body's length into
* *<b>len_out</b>, allocate and store a string for its body into
* *<b>body_out</b>, and return -1. (body_out will always be NUL-terminated,
* even if the control message body doesn't end with NUL.)
*
* If there is not a complete control message waiting, return 0.
*
* Return -1 on error.
*/
int fetch_from_buf_control(buf_t *buf, uint16_t *len_out, uint16_t *type_out, int fetch_from_buf_control(buf_t *buf, uint16_t *len_out, uint16_t *type_out,
char **body_out) char **body_out)
{ {
@ -657,8 +666,9 @@ int fetch_from_buf_control(buf_t *buf, uint16_t *len_out, uint16_t *type_out,
*len_out = len; *len_out = len;
*type_out = ntohs(get_uint16(buf->mem+2)); *type_out = ntohs(get_uint16(buf->mem+2));
if (len) { if (len) {
*body_out = tor_malloc(len); *body_out = tor_malloc(len+1);
memcpy(*body_out, buf->mem+4, len); memcpy(*body_out, buf->mem+4, len);
body_out[len] = '\0';
} else { } else {
*body_out = NULL; *body_out = NULL;
} }