From: Edward Hervey <edward@centricular.com>
Date: Mon, 20 Apr 2015 12:20:05 +0000 (+0200)
Subject: shmpipe: Ensure string received from recv() is NULL-terminated
X-Git-Tag: 1.6.0~1001
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=af49c109e456dcba341b7536549833ab95d80468;p=platform%2Fupstream%2Fgst-plugins-bad.git

shmpipe: Ensure string received from recv() is NULL-terminated

We will be doing string operations on it later.

CID #1292830
---

diff --git a/sys/shm/shmpipe.c b/sys/shm/shmpipe.c
index 0d7bf26..de89026 100644
--- a/sys/shm/shmpipe.c
+++ b/sys/shm/shmpipe.c
@@ -669,13 +669,15 @@ sp_client_recv (ShmPipe * self, char **buf)
       assert (cb.payload.new_shm_area.path_size > 0);
       assert (cb.payload.new_shm_area.size > 0);
 
-      area_name = malloc (cb.payload.new_shm_area.path_size);
+      area_name = malloc (cb.payload.new_shm_area.path_size + 1);
       retval = recv (self->main_socket, area_name,
           cb.payload.new_shm_area.path_size, 0);
       if (retval != cb.payload.new_shm_area.path_size) {
         free (area_name);
         return -3;
       }
+      /* Ensure area_name is NULL terminated */
+      area_name[retval] = 0;
 
       newarea = sp_open_shm (area_name, cb.area_id, 0,
           cb.payload.new_shm_area.size);