Browse Source

[settings] Handle errors in fetchf_uristring()

fetchf_uristring() was failing to handle error values from
fetch_setting(), resulting in its attempting to allocate extremely
large temporary buffers on the stack (and so overrunning the stack and
locking up the machine).

Problem reported by Shao Miller <Shao.Miller@yrdsb.edu.on.ca>.
tags/v0.9.7
Michael Brown 16 years ago
parent
commit
4e6b62c946
1 changed files with 4 additions and 1 deletions
  1. 4
    1
      src/core/settings.c

+ 4
- 1
src/core/settings.c View File

825
 static int fetchf_uristring ( struct settings *settings,
825
 static int fetchf_uristring ( struct settings *settings,
826
 			      struct setting *setting,
826
 			      struct setting *setting,
827
 			      char *buf, size_t len ) {
827
 			      char *buf, size_t len ) {
828
-	size_t raw_len;
828
+	ssize_t raw_len;
829
 
829
 
830
 	/* We need to always retrieve the full raw string to know the
830
 	/* We need to always retrieve the full raw string to know the
831
 	 * length of the encoded string.
831
 	 * length of the encoded string.
832
 	 */
832
 	 */
833
 	raw_len = fetch_setting ( settings, setting, NULL, 0 );
833
 	raw_len = fetch_setting ( settings, setting, NULL, 0 );
834
+	if ( raw_len < 0 )
835
+		return raw_len;
836
+
834
 	{
837
 	{
835
 		char raw_buf[ raw_len + 1 ];
838
 		char raw_buf[ raw_len + 1 ];
836
        
839
        

Loading…
Cancel
Save