[PATCH] smsutil: Prevent out of bounds reads in cbs_decode_text
Valgrind was complaining about it like this:
==18099== Conditional jump or move depends on uninitialised value(s)
==18099== at 0x4C32281: strspn
==18099== by 0x41286B: cbs_decode_text (smsutil.c:4140)
==18099== by 0x40675C: test_cbs_encode_decode (test-sms.c:1417)
---
src/smsutil.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/src/smsutil.c b/src/smsutil.c
index 2212994..24dcfaa 100644
--- a/src/smsutil.c
+++ b/src/smsutil.c
@@ -4135,12 +4135,13 @@ char *cbs_decode_text(GSList *cbs_list, char *iso639_lang)
*/
for (; i < written; i++, bufsize++) {
if (unpacked[i] == '\r') {
- int t;
+ int j;
- t = strspn((const char *) unpacked + i,
- "\r");
+ for (j = i + 1; j < written; j++)
+ if (unpacked[j] != '\r')
+ break;
- if (t + i == written)
+ if (j == written)
break;
}
--
1.9.1