Fix global-buffer-overflow in sqlcipher.c 98/83498/2
authorYury Usishchev <y.usishchev@samsung.com>
Mon, 25 Jul 2016 07:41:31 +0000 (10:41 +0300)
committerkyungwook tak <k.tak@samsung.com>
Tue, 16 Aug 2016 04:47:41 +0000 (21:47 -0700)
null-terminated string(pVfs->zName) has no assurance that the length
is longer than 10 so buffer-overflow can occured

Change-Id: I9dad1321ba2e8be4260feb33eb3874bb2c6cbb09
Signed-off-by: Yury Usishchev <y.usishchev@samsung.com>
src/manager/sqlcipher/sqlcipher.c

index 3d7f667..2008e5a 100644 (file)
@@ -31169,7 +31169,7 @@ static int fillInUnixFile(
   OSTRACE(("OPEN    %-3d %s\n", h, zFilename));
   pNew->h = h;
   pNew->zPath = zFilename;
-  if( memcmp(pVfs->zName,"unix-excl",10)==0 ){
+  if( strcmp(pVfs->zName,"unix-excl")==0 ){
     pNew->ctrlFlags = UNIXFILE_EXCL;
   }else{
     pNew->ctrlFlags = 0;