Browse Source

Fix use of strncat()

1a94c70336 introduced a unsafe use of
strncat(). strncat(dst, src, size) copies at most size characters *from src*
The intended function here was probably strlcat(), which exists only on BSD.
Checking the value of size is sufficient to determine if we can just use
strcat()

Also reintroduce a check that was added in 2c2deb87f8
pull/331/head
Even Rouault 8 years ago
parent
commit
7da4123fae
1 changed files with 4 additions and 5 deletions
  1. +4
    -5
      json_object.c

+ 4
- 5
json_object.c View File

@@ -774,17 +774,16 @@ static int json_object_double_to_json_string_format(struct json_object* jso,
size = snprintf(buf, sizeof(buf), format, jso->o.c_double);
buf[sizeof(buf)-1] = '\0';

if (modf(jso->o.c_double, &dummy) == 0)
if (modf(jso->o.c_double, &dummy) == 0 && size >= 0 && size < (int)sizeof(buf) - 2 )
{
// Ensure it looks like a float, even if snprintf didn't.
strncat(buf, ".0", sizeof(buf) - 1);
if (size >= 0)
size += 2; // yes, even if strncat ran out of room
strcat(buf, ".0");
size += 2;
}
}
buf[sizeof(buf)-1] = '\0';
// although unlikely, snprintf can fail
if (size < 0)
if (size < 0 || size >= (int)sizeof(buf) )
return -1;

p = strchr(buf, ',');


Loading…
Cancel
Save