From f373a82454a8331f0290f3138fa98a12a09de546 Mon Sep 17 00:00:00 2001 From: "R. Imura" Date: Wed, 24 Aug 2005 12:38:26 +0000 Subject: [PATCH] - Fix checking range of strings of struct iconv_add_in in libsmb and libkiconv, - Add checking range of strings to iconv_sysctl_add(). Submitted by: Rudolf Cejka --- contrib/smbfs/lib/smb/kiconv.c | 2 +- lib/libkiconv/xlat16_sysctl.c | 2 +- sys/libkern/iconv.c | 6 ++++++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/contrib/smbfs/lib/smb/kiconv.c b/contrib/smbfs/lib/smb/kiconv.c index 9447768bab3b..d84d9091fd36 100644 --- a/contrib/smbfs/lib/smb/kiconv.c +++ b/contrib/smbfs/lib/smb/kiconv.c @@ -52,7 +52,7 @@ kiconv_add_xlat_table(const char *to, const char *from, const u_char *table) struct iconv_add_out dout; size_t olen; - if (strlen(from) > ICONV_CSNMAXLEN || strlen(to) > ICONV_CSNMAXLEN) + if (strlen(from) >= ICONV_CSNMAXLEN || strlen(to) >= ICONV_CSNMAXLEN) return EINVAL; din.ia_version = ICONV_ADD_VER; strcpy(din.ia_converter, "xlat"); diff --git a/lib/libkiconv/xlat16_sysctl.c b/lib/libkiconv/xlat16_sysctl.c index 5078c28d16f6..28420d9d3d6b 100644 --- a/lib/libkiconv/xlat16_sysctl.c +++ b/lib/libkiconv/xlat16_sysctl.c @@ -54,7 +54,7 @@ kiconv_add_xlat16_table(const char *to, const char *from, const void *data, int struct iconv_add_out dout; size_t olen; - if (strlen(from) > ICONV_CSNMAXLEN || strlen(to) > ICONV_CSNMAXLEN) + if (strlen(from) >= ICONV_CSNMAXLEN || strlen(to) >= ICONV_CSNMAXLEN) return (EINVAL); din.ia_version = ICONV_ADD_VER; strcpy(din.ia_converter, "xlat16"); diff --git a/sys/libkern/iconv.c b/sys/libkern/iconv.c index 5bc1fdf54464..7010bb2f8fa1 100644 --- a/sys/libkern/iconv.c +++ b/sys/libkern/iconv.c @@ -379,6 +379,12 @@ iconv_sysctl_add(SYSCTL_HANDLER_ARGS) return EINVAL; if (din.ia_datalen > ICONV_CSMAXDATALEN) return EINVAL; + if (strlen(din.ia_from) >= ICONV_CSNMAXLEN) + return EINVAL; + if (strlen(din.ia_to) >= ICONV_CSNMAXLEN) + return EINVAL; + if (strlen(din.ia_converter) >= ICONV_CNVNMAXLEN) + return EINVAL; if (iconv_lookupconv(din.ia_converter, &dcp) != 0) return EINVAL; error = iconv_register_cspair(din.ia_to, din.ia_from, dcp, NULL, &csp);