Mailing-List: contact commits-help@celix.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@celix.apache.org
Date: Wed, 7 Jan 2015 22:40:35 +0000 (UTC)
From: "Daniel Parker (JIRA)" <jira@apache.org>
To: celix-commits@incubator.apache.org
Message-ID: <JIRA.12748896.1413556020000.32641.1420670435952@Atlassian.JIRA>
In-Reply-To: <JIRA.12748896.1413556020000@Atlassian.JIRA>
References: <JIRA.12748896.1413556020000@Atlassian.JIRA>
 <JIRA.12748896.1413556020750@arcas>
Subject: [jira] [Resolved] (CELIX-171) malloc() buffer overflows
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/CELIX-171?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Daniel Parker resolved CELIX-171.
---------------------------------
    Resolution: Duplicate

These memory allocation issues have been fixed by other bug fixes.

> malloc() buffer overflows
> -------------------------
>
>                 Key: CELIX-171
>                 URL: https://issues.apache.org/jira/browse/CELIX-171
>             Project: Celix
>          Issue Type: Bug
>          Components: Framework, Remote Service Admin
>            Reporter: Daniel Parker
>
> framework/private/src/filter.c::filter_parseValue() initializes a local string by calling strcup("") rather than actually allocating enough memory to store the resulting string.
> framework/private/src/filter.c::filter_parseSubstring() uses strlen() to determine how much memory to allocate, but the actual worst case size is the length of the string plus one for the trailing '\0'.
> remote_services/discovery/private/src/discovery_activator.c::bundleActivator_start() sets 'scope[len] = 0', which is one character past the end of the allocated memory.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)