[bugzilla-daemon@xxxxxxxxxxxxx]

Jakub Zawadzki changed bug 8600

What	Removed	Added
CC		darkjames-ws@darkjames.pl

Comment # 6 on bug 8600 from Jakub Zawadzki

Hi,

(In reply to comment #5)
> Created attachment 10656 [details]
> Decode PLAIN mechs username and password

859  length_user1 = strlen(decrypt);
860  if (returncode >= (length_user1 + 1)) {

This check is still unsafe, please write something like:


const char *decrypt_end = decrypt + returncode;

const char *username_end = memchr(decrypt, '\0', returncode);
if (username_end) {
   const char *password_start = username_end + 1;
   const char *password_end = 
     memchr(password_start, '\0', decrypt_end - password_start);
   ...
}

// please note that I'm not sure if I didn't do off by one error ;>

Cheers,
Kuba.

---

      You are receiving this mail because:

• You are watching all bug changes.