mirror of
https://github.com/libevent/libevent.git
synced 2025-01-31 09:12:55 +08:00
Convert evbuffer_strspn() (internal helper) to use size_t
As pointed by @yankeehacker in #590: Signed to Unsigned Conversion Error - buffer.c:1623 Description: This assignment creates a type mismatch by populating an unsigned variable with a signed value. The signed integer will be implicitly cast to an unsigned integer, converting negative values into positive ones. If an attacker can control the signed value, it may be possible to trigger a buffer overflow if the value specifies the length of a memory write. Remediation: Do not rely on implicit casts between signed and unsigned values because the result can take on an unexpected value and violate weak assumptions made elsewhere in the program. Fixes: #590
This commit is contained in:
parent
f83ac92da9
commit
931ec23702
4
buffer.c
4
buffer.c
@ -1535,11 +1535,11 @@ evbuffer_find_eol_char(struct evbuffer_ptr *it)
|
||||
return (-1);
|
||||
}
|
||||
|
||||
static inline int
|
||||
static inline size_t
|
||||
evbuffer_strspn(
|
||||
struct evbuffer_ptr *ptr, const char *chrset)
|
||||
{
|
||||
int count = 0;
|
||||
size_t count = 0;
|
||||
struct evbuffer_chain *chain = ptr->internal_.chain;
|
||||
size_t i = ptr->internal_.pos_in_chain;
|
||||
|
||||
|
Loading…
x
Reference in New Issue
Block a user