cups-CVE-2007-5849.patch

cups-CVE-2007-5849.patch (text/plain), 1017 bytes, created by Timo Gurr (RETIRED) on 2007-12-11 21:26:22 UTC

diff -Naur cups-1.3.4/backend/snmp.c cups-1.3.4.new/backend/snmp.c
--- cups-1.3.4/backend/snmp.c	2007-07-11 23:46:42.000000000 +0200
+++ cups-1.3.4.new/backend/snmp.c	2007-12-10 12:56:12.680574919 +0100
@@ -1064,18 +1064,38 @@
     char          *string,		/* I  - String buffer */
     int           strsize)		/* I  - String buffer size */
 {
-  if (length < strsize)
+  if (length < 0)
   {
-    memcpy(string, *buffer, length);
+   /*
+    * Disallow negative lengths!
+    */
+
+    fprintf(stderr, "ERROR: Bad ASN1 string length %d!\n", length);
+    *string = '\0';
+  }
+  else if (length < strsize)
+  {
+   /*
+    * String is smaller than the buffer...
+    */
+
+    if (length > 0)
+      memcpy(string, *buffer, length);
+
     string[length] = '\0';
   }
   else
   {
+   /*
+    * String is larger than the buffer...
+    */
+
     memcpy(string, buffer, strsize - 1);
     string[strsize - 1] = '\0';
   }
 
-  (*buffer) += length;
+  if (length > 0)
+    (*buffer) += length;
 
   return (string);
 }