walkero
/
nghttp2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Avoid memcpy against NULL src

This commit is contained in:
Tatsuhiro Tsujikawa 2016-11-01 23:54:21 +09:00
parent ee8440408c
commit ca6f6511f2
3 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/nghttp2_frame.c
View File

@ -869,7 +869,9 @@ int nghttp2_nv_array_copy(nghttp2_nv **nva_ptr, const nghttp2_nv *nva,
p->name = nva[i].name; p->name = nva[i].name;
p->namelen = nva[i].namelen; p->namelen = nva[i].namelen;
} else { } else {
memcpy(data, nva[i].name, nva[i].namelen); if (nva[i].namelen) {
memcpy(data, nva[i].name, nva[i].namelen);
}
p->name = data; p->name = data;
p->namelen = nva[i].namelen; p->namelen = nva[i].namelen;
data[p->namelen] = '\0'; data[p->namelen] = '\0';
@ -881,7 +883,9 @@ int nghttp2_nv_array_copy(nghttp2_nv **nva_ptr, const nghttp2_nv *nva,
p->value = nva[i].value; p->value = nva[i].value;
p->valuelen = nva[i].valuelen; p->valuelen = nva[i].valuelen;
} else { } else {
memcpy(data, nva[i].value, nva[i].valuelen); if (nva[i].valuelen) {
memcpy(data, nva[i].value, nva[i].valuelen);
}
p->value = data; p->value = data;
p->valuelen = nva[i].valuelen; p->valuelen = nva[i].valuelen;
data[p->valuelen] = '\0'; data[p->valuelen] = '\0';

4
lib/nghttp2_helper.c
View File

@ -503,6 +503,10 @@ int nghttp2_check_header_value(const uint8_t *value, size_t len) {
} }
uint8_t *nghttp2_cpymem(uint8_t *dest, const void *src, size_t len) { uint8_t *nghttp2_cpymem(uint8_t *dest, const void *src, size_t len) {
if (len == 0) {
return dest;
}
memcpy(dest, src, len); memcpy(dest, src, len);
return dest + len; return dest + len;

5
lib/nghttp2_rcbuf.c
View File

@ -28,6 +28,7 @@
#include <assert.h> #include <assert.h>
#include "nghttp2_mem.h" #include "nghttp2_mem.h"
#include "nghttp2_helper.h"
int nghttp2_rcbuf_new(nghttp2_rcbuf **rcbuf_ptr, size_t size, int nghttp2_rcbuf_new(nghttp2_rcbuf **rcbuf_ptr, size_t size,
nghttp2_mem *mem) { nghttp2_mem *mem) {
@ -58,10 +59,8 @@ int nghttp2_rcbuf_new2(nghttp2_rcbuf **rcbuf_ptr, const uint8_t *src,
return rv; return rv;
} }
memcpy((*rcbuf_ptr)->base, src, srclen);
(*rcbuf_ptr)->len = srclen; (*rcbuf_ptr)->len = srclen;
(*rcbuf_ptr)->base[srclen] = '\0'; *nghttp2_cpymem((*rcbuf_ptr)->base, src, srclen) = '\0';
return 0; return 0;
} }