From 7ff99e308ed5a17c8b9c746fed1bff75ecf6d66f Mon Sep 17 00:00:00 2001 From: Scott Bertin Date: Wed, 11 Apr 2018 15:30:30 -0400 Subject: [PATCH 1/2] Fix problem exactly filling a buffer when encoding. The size check suffered from an off by one error. This also avoids problems with overflow. --- src/cn-encoder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/cn-encoder.c b/src/cn-encoder.c index d8a4d49..e436f5a 100644 --- a/src/cn-encoder.c +++ b/src/cn-encoder.c @@ -35,7 +35,7 @@ typedef struct _write_state ssize_t size; } cn_write_state; -#define ensure_writable(sz) if ((ws->offset<0) || (ws->offset + (sz) >= ws->size)) { \ +#define ensure_writable(sz) if ((ws->offset<0) || (ws->size - ws->offset < (sz))) { \ ws->offset = -1; \ return; \ } @@ -302,6 +302,7 @@ ssize_t cn_cbor_encoder_write(uint8_t *buf, const cn_cbor *cb) { cn_write_state ws = { buf, buf_offset, buf_size }; + if (ws.size < 0) { return -1; } _visit(cb, _encoder_visitor, _encoder_breaker, &ws); if (ws.offset < 0) { return -1; } return ws.offset - buf_offset; From 1377c158cbe52eb53d37da35d18c2e43eadea07c Mon Sep 17 00:00:00 2001 From: Scott Bertin Date: Fri, 13 Apr 2018 09:35:38 -0400 Subject: [PATCH 2/2] Change ws.size check to an assert --- src/cn-encoder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/cn-encoder.c b/src/cn-encoder.c index e436f5a..3ab4f81 100644 --- a/src/cn-encoder.c +++ b/src/cn-encoder.c @@ -302,7 +302,7 @@ ssize_t cn_cbor_encoder_write(uint8_t *buf, const cn_cbor *cb) { cn_write_state ws = { buf, buf_offset, buf_size }; - if (ws.size < 0) { return -1; } + assert(ws.size > 0); _visit(cb, _encoder_visitor, _encoder_breaker, &ws); if (ws.offset < 0) { return -1; } return ws.offset - buf_offset;