From f14122f09967399e80765b7b20c4cb32b38edc90 Mon Sep 17 00:00:00 2001 From: David Korczynski Date: Fri, 28 Jul 2023 06:20:36 -0700 Subject: [PATCH] config_format: fix possible heap overflow The return value of `strchr` is not checked for failure. If it's failure then `tmp` will be `0` in the `(tmp-p)` calculation, causing `xlen` to be `p`. `xlen` is later used for copying memory by way of `memcpy` in string creation using `flb_sds_create_len`. This fixes it. Signed-off-by: David Korczynski --- src/config_format/flb_config_format.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/config_format/flb_config_format.c b/src/config_format/flb_config_format.c index a62bda96ab7..af4f56b9d27 100644 --- a/src/config_format/flb_config_format.c +++ b/src/config_format/flb_config_format.c @@ -420,6 +420,9 @@ struct flb_kv *flb_cf_meta_property_add(struct flb_cf *cf, char *meta, int len) p = meta; tmp = strchr(p, ' '); + if (tmp == NULL) { + return NULL; + } xlen = (tmp - p); /* create k/v pair */