diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2011-04-13 18:18:03 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2011-04-13 18:18:03 +0200 |
| commit | aee071ed8b4dc05b12d5eda2622a097dadbea1ea (patch) | |
| tree | 67ad8e2ec26d7d2c260a0e18879ead6dd0371428 /src | |
| parent | e54a2bd20ef1195777502ec2b2663e2fba2a8b24 (diff) | |
| download | strongswan-aee071ed8b4dc05b12d5eda2622a097dadbea1ea.tar.bz2 strongswan-aee071ed8b4dc05b12d5eda2622a097dadbea1ea.tar.xz | |
Fixed check for member of stroke_msg_t in pop_string.
Because of the cast to char** the length of the message was multiplied
by sizeof(char*), i.e. 4 or 8 bytes (depending on the architecture) instead
of by 1 (sizeof(char)).
Diffstat (limited to 'src')
| -rw-r--r-- | src/libcharon/plugins/stroke/stroke_socket.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/libcharon/plugins/stroke/stroke_socket.c b/src/libcharon/plugins/stroke/stroke_socket.c index 18e77905d..423322d91 100644 --- a/src/libcharon/plugins/stroke/stroke_socket.c +++ b/src/libcharon/plugins/stroke/stroke_socket.c @@ -122,7 +122,7 @@ static void pop_string(stroke_msg_t *msg, char **string) /* check for sanity of string pointer and string */ if (string < (char**)msg || - string > (char**)msg + sizeof(stroke_msg_t) || + string > (char**)((char*)msg + sizeof(stroke_msg_t)) || (unsigned long)*string < (unsigned long)((char*)msg->buffer - (char*)msg) || (unsigned long)*string > msg->length) { |