diff options
| author | Jimmy <nhminus@gmail.com> | 2019-12-05 14:45:17 +0800 |
|---|---|---|
| committer | Tomas Vanek <vanekt@fbl.cz> | 2019-12-12 14:31:42 +0000 |
| commit | 0f12d792ed5ab2b8f934e689b8a23f8c55f1f218 (patch) | |
| tree | 2636e9feada70b57867a21fd79d7f768d14d29eb | |
| parent | 1e427fd580ad94bb3bf29d4e02ef81361c920f28 (diff) | |
server/tcl_server.c: Fix buffer overrun
The input buffer size is checked only after writing past its end.
Change-Id: I6a9651c5b7d82efe338468d67bf6caca41004b01
Signed-off-by: Jimmy <nhminus@gmail.com>
Reviewed-on: http://openocd.zylin.com/5352
Tested-by: jenkins
Reviewed-by: Tomas Vanek <vanekt@fbl.cz>
| -rw-r--r-- | src/server/tcl_server.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/server/tcl_server.c b/src/server/tcl_server.c index 1ec45ffb..1735c43f 100644 --- a/src/server/tcl_server.c +++ b/src/server/tcl_server.c @@ -199,7 +199,7 @@ static int tcl_input(struct connection *connection) for (i = 0; i < rlen; i++) { /* buffer the data */ tclc->tc_line[tclc->tc_lineoffset] = in[i]; - if (tclc->tc_lineoffset < tclc->tc_line_size) { + if (tclc->tc_lineoffset + 1 < tclc->tc_line_size) { tclc->tc_lineoffset++; } else if (tclc->tc_line_size >= TCL_LINE_MAX) { /* maximum line size reached, drop line */ |