Ticket #92 (closed defect: fixed)
Unintended pointer incrementation in function outputResponse
| Reported by: | Knut Landmark | Owned by: | |
|---|---|---|---|
| Priority: | major | Milestone: | |
| Component: | zoo-kernel | Version: | |
| Keywords: | Cc: |
Description
The following clause in function outputResponse (zoo-kernel/service_internal.c, rev. 459, line 1998 ) causes unexpected behavior:
if(lenv!=NULL){
tmp0=(char*)malloc((strlen(lenv->value)+strlen(_("Unable to run the Service. The message returned back by the Service was the following: "+1)))*sizeof(char));
sprintf(tmp0,_("Unable to run the Service. The message returned back by the Service was the following: %s"),lenv->value);
}
The const char* argument to strlen is incremented by +1, whereas the intention is to allocate an additional byte. Line 1999 should presumably be written
tmp0=(char*)malloc((strlen(lenv->value)+strlen(_("Unable to run the Service. The message returned back by the Service was the following: "))+1)*sizeof(char));
Change History
Note: See
TracTickets for help on using
tickets.













