[Asterisk-code-review] func_env: Prevent FILE() from reading garbage at end-of-file (asterisk[13])

[Sean Bright]

Sean Bright has uploaded this change for review. ( https://gerrit.asterisk.org/c/asterisk/+/13175 )


Change subject: func_env: Prevent FILE() from reading garbage at end-of-file
......................................................................

func_env: Prevent FILE() from reading garbage at end-of-file

If the last line of a file does not have a terminating EOL sequence, we
potentially add garbage to the value returned from the FILE() function.

There is no overflow potential here as we are reading from a buffer of a
known size, we are just reading too much of it.

ASTERISK-26481 #close

Change-Id: I50dd4fcf416fb3c83150040a1a79a59d9eb1ae01
---
M funcs/func_env.c
1 file changed, 3 insertions(+), 2 deletions(-)



  git pull ssh://gerrit.asterisk.org:29418/asterisk refs/changes/75/13175/1

diff --git a/funcs/func_env.c b/funcs/func_env.c
index 9a564e1..0b143fd 100644
--- a/funcs/func_env.c
+++ b/funcs/func_env.c
@@ -711,12 +711,13 @@
 		ast_debug(3, "offset=%" PRId64 ", length=%" PRId64 ", offset_offset=%" PRId64 ", length_offset=%" PRId64 "\n", offset, length, offset_offset, length_offset);
 		for (i = offset_offset; i < flength; i += sizeof(fbuf)) {
 			char *pos;
-			if (fread(fbuf, 1, sizeof(fbuf), ff) < sizeof(fbuf) && !feof(ff)) {
+			size_t bytes_read;
+			if ((bytes_read = fread(fbuf, 1, sizeof(fbuf), ff)) < sizeof(fbuf) && !feof(ff)) {
 				ast_log(LOG_ERROR, "Short read?!!\n");
 				fclose(ff);
 				return -1;
 			}
-			for (pos = fbuf; pos < fbuf + sizeof(fbuf); pos++) {
+			for (pos = fbuf; pos < fbuf + bytes_read; pos++) {
 				LINE_COUNTER(pos, format, current_length);
 
 				if (current_length == length) {

-- 
To view, visit https://gerrit.asterisk.org/c/asterisk/+/13175
To unsubscribe, or for help writing mail filters, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: 13
Gerrit-Change-Id: I50dd4fcf416fb3c83150040a1a79a59d9eb1ae01
Gerrit-Change-Number: 13175
Gerrit-PatchSet: 1
Gerrit-Owner: Sean Bright <sean.bright at gmail.com>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20191113/c543d8d7/attachment-0001.html>