From 4e6b62c94627d1e05aa986f66054df5f841fe53b Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 12 Feb 2009 09:16:53 +0000 Subject: [PATCH] [settings] Handle errors in fetchf_uristring() fetchf_uristring() was failing to handle error values from fetch_setting(), resulting in its attempting to allocate extremely large temporary buffers on the stack (and so overrunning the stack and locking up the machine). Problem reported by Shao Miller . --- src/core/settings.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/core/settings.c b/src/core/settings.c index 2c886fdf..29e56b32 100644 --- a/src/core/settings.c +++ b/src/core/settings.c @@ -825,12 +825,15 @@ static int storef_uristring ( struct settings *settings, static int fetchf_uristring ( struct settings *settings, struct setting *setting, char *buf, size_t len ) { - size_t raw_len; + ssize_t raw_len; /* We need to always retrieve the full raw string to know the * length of the encoded string. */ raw_len = fetch_setting ( settings, setting, NULL, 0 ); + if ( raw_len < 0 ) + return raw_len; + { char raw_buf[ raw_len + 1 ];