diff options
| author | Werner Koch <wk@gnupg.org> | 2012-11-05 19:01:01 +0100 |
|---|---|---|
| committer | Werner Koch <wk@gnupg.org> | 2012-11-05 19:01:01 +0100 |
| commit | 79502e2c1982047dcf2b776f52826f38bbd9b1fe (patch) | |
| tree | 2d1190f2446185981cccf2b2242e352a561c9ee6 /mpi/mpicoder.c | |
| parent | 66adf76e634423bb72ce1f0b5ed78f4e4798f190 (diff) | |
| download | libgcrypt-79502e2c1982047dcf2b776f52826f38bbd9b1fe.tar.gz | |
Avoid dereferencing pointer right after the end
* mpi/mpicoder.c (do_get_buffer): Check the length before derefing P.
--
Christian Grothoff found this bug using Valgrind.
Diffstat (limited to 'mpi/mpicoder.c')
| -rw-r--r-- | mpi/mpicoder.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mpi/mpicoder.c b/mpi/mpicoder.c index f499796d..a3435ed1 100644 --- a/mpi/mpicoder.c +++ b/mpi/mpicoder.c @@ -270,7 +270,7 @@ do_get_buffer (gcry_mpi_t a, unsigned int *nbytes, int *sign, int force_secure) /* This is sub-optimal but we need to do the shift operation because the caller has to free the returned buffer. */ - for (p=buffer; !*p && *nbytes; p++, --*nbytes) + for (p=buffer; *nbytes && !*p; p++, --*nbytes) ; if (p != buffer) memmove (buffer,p, *nbytes); |