From 106fae3b26b85526cc82d067423b6ac6849f70df Mon Sep 17 00:00:00 2001 From: Michael Davidsaver Date: Tue, 29 Mar 2016 17:36:39 +0900 Subject: [PATCH] dbStatic: prevent overflow in dbPutString() The bounds check should be before the string copy. Also zero the last element out of paranoia (should already be zero). Fix lp:1563191 --- src/dbStatic/dbStaticLib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/dbStatic/dbStaticLib.c b/src/dbStatic/dbStaticLib.c index ab87911f3..655a08536 100644 --- a/src/dbStatic/dbStaticLib.c +++ b/src/dbStatic/dbStaticLib.c @@ -2198,7 +2198,10 @@ long epicsShareAPI dbPutString(DBENTRY *pdbentry,const char *pstring) switch (pflddes->field_type) { case DBF_STRING: if(!pfield) return(S_dbLib_fieldNotFound); - strncpy((char *)pfield, pstring,pflddes->size); + if(strlen(pstring) >= (size_t)pflddes->size) return S_dbLib_strLen; + strncpy((char *)pfield, pstring, pflddes->size-1); + ((char *)pfield)[pflddes->size-1] = 0; + if((pflddes->special == SPC_CALC) && !stringHasMacro) { char rpcl[RPCL_LEN]; short err; @@ -2209,7 +2212,6 @@ long epicsShareAPI dbPutString(DBENTRY *pdbentry,const char *pstring) calcErrorStr(err), pstring); } } - if((short)strlen(pstring) >= pflddes->size) status = S_dbLib_strLen; break; case DBF_CHAR: