提交 533b178d 编写于 作者: P Pauli 提交者: Rich Salz

Avoid buffer underflow in evp_test.

The second loop in the remove_space function doesn't check for walking
back off of the start of the string while setting white space to 0.

This fix exits this loop once the pointer is before the (updated) beginning
of the string.
Reviewed-by: NRichard Levitte <levitte@openssl.org>
Reviewed-by: NRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2752)
上级 fa7e9ed3
......@@ -23,17 +23,17 @@
static void remove_space(char **pval)
{
unsigned char *p = (unsigned char *)*pval;
unsigned char *p = (unsigned char *)*pval, *beginning;
while (isspace(*p))
p++;
*pval = (char *)p;
*pval = (char *)(beginning = p);
p = p + strlen(*pval) - 1;
/* Remove trailing space */
while (isspace(*p))
while (p >= beginning && isspace(*p))
*p-- = 0;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册