CVE-2015-5330: Fix handling of unicode near string endings
authorDouglas Bagnall <douglas.bagnall@catalyst.net.nz>
Tue, 24 Nov 2015 00:47:16 +0000 (13:47 +1300)
committerRalph Boehme <slow@samba.org>
Wed, 9 Dec 2015 16:19:52 +0000 (17:19 +0100)
commitba5dbda6d0174a59d221c45cca52ecd232820d48
tree40877c8684b61ad38c9573435479892c3fa47aeb
parent0454b95657846fcecf0f51b6f1194faac02518bd
CVE-2015-5330: Fix handling of unicode near string endings

Until now next_codepoint_ext() and next_codepoint_handle_ext() were
using strnlen(str, 5) to determine how much string they should try to
decode. This ended up looking past the end of the string when it was not
null terminated and the final character looked like a multi-byte encoding.
The fix is to let the caller say how long the string can be.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
lib/util/charset/charset.h
lib/util/charset/codepoints.c
lib/util/charset/util_str.c
lib/util/charset/util_unistr.c