556299 - secmod_doDescCopy miscomputes buffer size, leaks allocated string

Status: NEW

(NSS :: Libraries, defect, P2)

Description

[timeless]

275 secmod_doDescCopy(char *target, int *targetLen, const char *desc,

282     if (diff > 0) {
283         /* we need to escape... expand newSpecPtr as well to make sure
284          * we don't overflow it */

291         value = secmod_addEscape(value, '\"');

299     PORT_Memcpy(target, value, esc_len);

302     return target;

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

There's something else wrong in this function.

280     esc_len = secmod_escapeSize(value, '\"') - 1;
281     diff = esc_len - strlen(value);
282     if (diff > 0) {
283         /* we need to escape... expand newSpecPtr as well to make sure
284          * we don't overflow it */
285         char *newPtr = PORT_Realloc(target, *targetLen * diff);
                                                           ^
'*' ?  I think not.  '+' I think.  Maybe "+ something * diff".