arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-04-21 10:26:06 +03:00
Code

Avoid copying past end of buffer in String.concat (#8198)

Browse Source
This commit is contained in:
Paulo Cabral Sanz 2021-07-08 20:35:09 -03:00 committed by GitHub
parent a105bdd359
commit 2946ce055c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cores/esp8266/WString.cpp
View File

@ -305,7 +305,7 @@ bool String::concat(const char *cstr, unsigned int length) {
return true; return true;
if (!reserve(newlen)) if (!reserve(newlen))
return false; return false;
memmove_P(wbuffer() + len(), cstr, length + 1); memmove_P(wbuffer() + len(), cstr, length);
setLen(newlen); setLen(newlen);
wbuffer()[newlen] = 0; wbuffer()[newlen] = 0;
return true; return true;

10
tests/host/core/test_string.cpp
View File

@ -594,3 +594,13 @@ TEST_CASE("String chaining", "[core][String]")
REQUIRE(static_cast<const void*>(result.c_str()) == static_cast<const void*>(ptr)); REQUIRE(static_cast<const void*>(result.c_str()) == static_cast<const void*>(ptr));
} }
} }
TEST_CASE("String concat OOB #8198", "[core][String]")
{
char *p = (char*)malloc(16);
memset(p, 'x', 16);
String s = "abcd";
s.concat(p, 16);
REQUIRE(!strcmp(s.c_str(), "abcdxxxxxxxxxxxxxxxx"));
free(p);
}