xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

libc: fix overflow of domain component rune buffer for idn2utf()

Browse source 
If the source string has a run of more than 256 runes without
a "." dot, we'd overflow the runebuffer in idn2utf().

The utf2idn() routine had a check in the while loop, but that
is actually wrong too, as it would insert a dot and restart
the loop in the middle of a domain component. Just error
out if a domain component is too long.
This commit is contained in:
cinap_lenrek 2021-10-31 12:39:46 +00:00
parent 7b4e3be27e
commit 9d15403fda
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
sys/src/libc/9sys/idn.c
View file

@ -200,6 +200,8 @@ idn2utf(char *name, char *buf, int nbuf)
n = chartorune(&r, cp+nc);
if(r == '.')
break;
if(nr >= nelem(rb))
return -1;
rb[nr++] = r;
nc += n;
}
@ -234,10 +236,12 @@ utf2idn(char *name, char *buf, int nbuf)
cp = name;
for(;;){
nc = nr = 0;
while(cp[nc] != 0 && nr < nelem(rb)){
while(cp[nc] != 0){
n = chartorune(&r, cp+nc);
if(r == '.')
break;
if(nr >= nelem(rb))
return -1;
rb[nr++] = r;
nc += n;
}