diff options
| author |   Jose Bollo <jose.bollo@iot.bzh> | 2019-12-20 14:55:28 +0100 |
|---|---|---|
| committer | Jose Bollo <jose.bollo@iot.bzh> | 2019-12-20 14:58:10 +0100 |
| commit | 2ed1d659b481c50380faed568818443d092f06ec (patch) | |
| tree | 95d4cff1564446a8821f8fb31cc805c89992fcab /src/afb-token.c | |
| parent | 6422dd2e6bee2903690fe430b0e7a666179ec163 (diff) | |
afb-token: Fix a critical bugicefish_8.99.4icefish/8.99.48.99.4
Management of tokens had a big bug, due to insufficent testing.
This fixes the issue that leaded to memory crashes.
BUG-AGL: SPEC-3066
Change-Id: If967ec58ed04dc715d255a5e7c2196133ce3ec4a
Signed-off-by: Jose Bollo <jose.bollo@iot.bzh>
Diffstat (limited to 'src/afb-token.c')
| -rw-r--r-- | src/afb-token.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/afb-token.c b/src/afb-token.c index f6f5eb73..21eb3c0e 100644 --- a/src/afb-token.c +++ b/src/afb-token.c @@ -86,7 +86,7 @@ int afb_token_get(struct afb_token **token, const char *tokenstring) /* search the token */ tok = tokenset.first; - while (tok && memcmp(tokenstring, tok->text, length)) + while (tok && (memcmp(tokenstring, tok->text, length) || tokenstring[length])) tok = tok->next; /* search done */ @@ -96,7 +96,7 @@ int afb_token_get(struct afb_token **token, const char *tokenstring) rc = 0; } else { /* not found, create */ - tok = malloc(length + sizeof *tok); + tok = malloc(length + 1 + sizeof *tok); if (!tok) /* creation failed */ rc = -ENOMEM; @@ -106,7 +106,7 @@ int afb_token_get(struct afb_token **token, const char *tokenstring) tokenset.first = tok; tok->id = tokenset.idgen; tok->refcount = 1; - memcpy(tok->text, tokenstring, length); + memcpy(tok->text, tokenstring, length + 1); rc = 0; } } @@ -140,6 +140,7 @@ void afb_token_unref(struct afb_token *token) pthread_mutex_lock(&tokenset.mutex); pt = &tokenset.first; while (*pt && *pt != token) + pt = &(*pt)->next; if (*pt) *pt = token->next; pthread_mutex_unlock(&tokenset.mutex); |