Skip to content

Commit

Permalink
Fix broken strdup
Browse files Browse the repository at this point in the history
strdup added an unnecessary null terminator, creating heap overflow and crashes.
  • Loading branch information
kontakt committed Aug 23, 2016
1 parent 0e2fe03 commit 4c0b2be
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 5 deletions.
2 changes: 1 addition & 1 deletion src/a2_strdup.c
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
char *a2_strdup(const char *str) {
size_t len = strlen(str) + 1;
char *dup = malloc(len);
dup[len] = '\0';
//dup[len] = '\0';
strcpy(dup, str);
return dup;
}
4 changes: 0 additions & 4 deletions src/card_layer.c
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,6 @@ bool card_layer_set_index(CardLayer *card_layer, uint8_t index) {
layer_mark_dirty(card_layer->layer);

// NAME

if (card_layer->name_text) free(card_layer->name_text);

const uint32_t name_key = STORAGE_CARD_VALUE(NAME, index);
Expand All @@ -248,17 +247,14 @@ bool card_layer_set_index(CardLayer *card_layer, uint8_t index) {
layer_set_hidden((Layer *)card_layer->value_text_layer, false);

if (card_layer->value_text) free(card_layer->value_text);

const uint32_t value_key = STORAGE_CARD_VALUE(VALUE, index);
char value_buffer[32];
int value_bytes_read = persist_read_string(value_key, value_buffer, sizeof(value_buffer));
value_buffer[MAX(0, value_bytes_read)] = '\0';

card_layer->value_text = strdup(value_buffer);
text_layer_set_text(card_layer->value_text_layer, card_layer->value_text);
} else {
layer_set_hidden((Layer *)card_layer->value_text_layer, true);
}

return true;
}

0 comments on commit 4c0b2be

Please sign in to comment.