[sword-devel] Out-of-bounds read in RemoteTransport::copyDirectory()

Jaak Ristioja jaak at ristioja.ee
Fri Sep 23 14:12:34 MST 2016


Hi!

There is no check for (buffer.length() >= strlen(suffix)) before the
strcmp() condition:

    if (!strcmp(&buffer.c_str()[buffer.length()-strlen(suffix)], suffix)) {

which might lead to undefined behaviour.

Best regards,
Jaak



More information about the sword-devel mailing list