Browse Source

Fixed one byte stack overflow in mcast recvfrom.

The actual overflow happens when enforcing the NULL termination shortly
after the recvfrom.
Tim Bateman 12 years ago
parent
commit
9f5d18daf3
1 changed files with 1 additions and 1 deletions
  1. 1 1
      api.c

+ 1 - 1
api.c

@@ -3947,7 +3947,7 @@ static void mcast()
 
 
 		count++;
 		count++;
 		came_from_siz = sizeof(came_from);
 		came_from_siz = sizeof(came_from);
-		if (SOCKETFAIL(rep = recvfrom(mcast_sock, buf, sizeof(buf),
+		if (SOCKETFAIL(rep = recvfrom(mcast_sock, buf, sizeof(buf) - 1,
 						0, (struct sockaddr *)(&came_from), &came_from_siz))) {
 						0, (struct sockaddr *)(&came_from), &came_from_siz))) {
 			applog(LOG_DEBUG, "API mcast failed count=%d (%s) (%d)",
 			applog(LOG_DEBUG, "API mcast failed count=%d (%s) (%d)",
 					count, SOCKERRMSG, (int)mcast_sock);
 					count, SOCKERRMSG, (int)mcast_sock);