From 6692961c25d77dc0846b17bd4b7fd5b513de0599 Mon Sep 17 00:00:00 2001 From: samanway Date: Tue, 4 Feb 2020 16:37:38 +0530 Subject: [PATCH] [CONPRO-1561] Crash in memcpy - In Caremotehandler.c, function CACloneInfo was copying token into buffer in vulnurable way - Fixed it appending NULL in destination string https://github.sec.samsung.net/RS7-IOTIVITY/IoTivity/pull/662 (cherry-picked from f8af2d6ca117bdf270c97c5c28f86bb0169659e5) Change-Id: I84dfff77ecbf3a333913ce341060d7e30444ac62 Signed-off-by: samanway Signed-off-by: DoHyun Pyun --- resource/csdk/connectivity/common/src/caremotehandler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resource/csdk/connectivity/common/src/caremotehandler.c b/resource/csdk/connectivity/common/src/caremotehandler.c index 1e5b7e9..638c04f 100644 --- a/resource/csdk/connectivity/common/src/caremotehandler.c +++ b/resource/csdk/connectivity/common/src/caremotehandler.c @@ -261,7 +261,7 @@ CAResult_t CACloneInfo(const CAInfo_t *info, CAInfo_t *clone) // allocate token field uint8_t len = info->tokenLength; - char *temp = (char *) OICMalloc(len * sizeof(char)); + char *temp = (char *) OICCalloc(1, (len + 1) * sizeof(char)); if (!temp) { OIC_LOG(ERROR, TAG, "CACloneInfo Out of memory"); -- 2.7.4