From 46b619c39d7304493a550270adf92be3147b3878 Mon Sep 17 00:00:00 2001 From: Rene Gollent Date: Wed, 22 Jun 2011 12:52:28 +0000 Subject: [PATCH] Fix several problems in Flatten() that could potentially lead to overflows and/or crashes if given a smaller buffer size than the Flatten operation actually required. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@42282 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/kits/app/Message.cpp | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/kits/app/Message.cpp b/src/kits/app/Message.cpp index bad7d798cb..a4af4651c1 100644 --- a/src/kits/app/Message.cpp +++ b/src/kits/app/Message.cpp @@ -1011,21 +1011,20 @@ BMessage::Flatten(char *buffer, ssize_t size) const if (fHeader == NULL) return B_NO_INIT; + if (size < FlattenedSize()) + return B_BUFFER_OVERFLOW; + /* we have to sync the what code as it is a public member */ fHeader->what = what; - memcpy(buffer, fHeader, min_c(sizeof(message_header), (size_t)size)); + memcpy(buffer, fHeader, sizeof(message_header)); buffer += sizeof(message_header); - size -= sizeof(message_header); size_t fieldsSize = fHeader->field_count * sizeof(field_header); - memcpy(buffer, fFields, min_c(fieldsSize, (size_t)size)); + memcpy(buffer, fFields, fieldsSize); buffer += fieldsSize; - size -= fieldsSize; - memcpy(buffer, fData, min_c(fHeader->data_size, (size_t)size)); - if ((size_t)size < fHeader->data_size) - return B_BUFFER_OVERFLOW; + memcpy(buffer, fData, fHeader->data_size); return B_OK; }