From 1ff20069a1888a77bc3c7d20fb6e0e2cbd82caca Mon Sep 17 00:00:00 2001 From: Thomas Bernard Date: Sun, 20 Apr 2014 18:10:44 +0200 Subject: [PATCH] miniupnpd/options.c: fix potential end of array access --- miniupnpd/options.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/miniupnpd/options.c b/miniupnpd/options.c index 489cc7b..a908928 100644 --- a/miniupnpd/options.c +++ b/miniupnpd/options.c @@ -140,8 +140,10 @@ readoptionsfile(const char * fname) /* check for comments or empty lines */ if(name[0] == '#' || name[0] == '\0') continue; + len = strlen(name); /* length of the whole line excluding leading + * and ending white spaces */ /* check for UPnP permissions rule */ - if(0 == memcmp(name, "allow", 5) || 0 == memcmp(name, "deny", 4)) + if((len > 6) && (0 == memcmp(name, "allow", 5) || 0 == memcmp(name, "deny", 4))) { tmp = realloc(upnppermlist, sizeof(struct upnpperm) * (num_upnpperm+1)); if(tmp == NULL) @@ -167,7 +169,7 @@ readoptionsfile(const char * fname) } #ifdef PCP_SADSCP /* check for DSCP values configuration */ - if(0 == memcmp(name, "set_learn_dscp", sizeof("set_learn_dscp")-1) ) + if((len > 15) && 0 == memcmp(name, "set_learn_dscp", sizeof("set_learn_dscp")-1) ) { tmp = realloc(dscp_values_list, sizeof(struct dscp_values) * (num_dscp_values+1)); if(tmp == NULL)