search

zint / zint-gpl-only

Zint Barcode Generator
https://zint.org.uk/
GNU General Public License v3.0
525 stars 138 forks source link

Bad string allocation #46

Closed arnejpackz closed 2 years ago

arnejpackz commented 9 years ago

In zint/backend/rss.c I encountered this problem:

char* general_field = (char*)_alloca(strlen(source)); char* general_field_type = (char*)_alloca(strlen(source));

char* reduced = (char*)_alloca(src_len); char* binary_string = (char*)_alloca(7 * src_len);

if(strlen(binary_string) < 36) { remainder = 36 - strlen(binary_string); }

Obviously, the amount of bytes allocated for each string should be increased with one. The variable remainder should be

if(strlen(binary_string) < 36) { remainder = 35 - strlen(binary_string); }

gitlost commented 2 years ago

I believe the current logic in the latest version of Zint does not suffer this issue, so am closing, but if not please raise a ticket at https://sourceforge.net/p/zint/tickets/ as this fork is no longer in use. Thanks for the feedback.