• Jeff King's avatar
    compat/inet_ntop: fix off-by-one in inet_ntop4 · db85a8a9
    Jeff King authored
    Our compat inet_ntop4 function writes to a temporary buffer
    with snprintf, and then uses strcpy to put the result into
    the final "dst" buffer. We check the return value of
    snprintf against the size of "dst", but fail to account for
    the NUL terminator. As a result, we may overflow "dst" with
    a single NUL. In practice, this doesn't happen because the
    output of inet_ntop is limited, and we provide buffers that
    are way oversized.
    We can fix the off-by-one check easily, but while we are
    here let's also use strlcpy for increased safety, just in
    case there are other bugs lurking.
    As a side note, this compat code seems to be BSD-derived.
    Searching for "vixie inet_ntop" turns up NetBSD's latest
    version of the same code, which has an identical fix (and
    switches to strlcpy, too!).
    Signed-off-by: default avatarJeff King <peff@peff.net>
    Signed-off-by: default avatarJunio C Hamano <gitster@pobox.com>
inet_ntop.c 4.79 KB