CVE-2015-5330: Fix handling of unicode near string endings
authorDouglas Bagnall <douglas.bagnall@catalyst.net.nz>
Tue, 24 Nov 2015 00:47:16 +0000 (13:47 +1300)
committerRalph Boehme <slow@samba.org>
Wed, 9 Dec 2015 16:17:05 +0000 (17:17 +0100)
commit5f3c7541c2f10ac2174538288f6569af587d69f0
tree65dea1379875a6d33c62d77ef0ff188ce61babac
parent7bcac237656083e67bbac9b50be9b319bb2d7eb8
CVE-2015-5330: Fix handling of unicode near string endings

Until now next_codepoint_ext() and next_codepoint_handle_ext() were
using strnlen(str, 5) to determine how much string they should try to
decode. This ended up looking past the end of the string when it was not
null terminated and the final character looked like a multi-byte encoding.
The fix is to let the caller say how long the string can be.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
lib/util/charset/charset.h
lib/util/charset/codepoints.c
lib/util/charset/util_str.c
lib/util/charset/util_unistr.c