Browse Source

Fixed one byte stack overflow in mcast recvfrom.

The actual overflow happens when enforcing the NULL termination shortly
after the recvfrom.
Tim Bateman 12 years ago
parent
commit
fc59e97019
1 changed files with 1 additions and 1 deletions
  1. 1 1
      api.c

+ 1 - 1
api.c

@@ -3762,7 +3762,7 @@ static void mcast()
 
 
 		count++;
 		count++;
 		came_from_siz = sizeof(came_from);
 		came_from_siz = sizeof(came_from);
-		if (SOCKETFAIL(rep = recvfrom(mcast_sock, buf, sizeof(buf),
+		if (SOCKETFAIL(rep = recvfrom(mcast_sock, buf, sizeof(buf) - 1,
 						0, (struct sockaddr *)(&came_from), &came_from_siz))) {
 						0, (struct sockaddr *)(&came_from), &came_from_siz))) {
 			applog(LOG_DEBUG, "API mcast failed count=%d (%s) (%d)",
 			applog(LOG_DEBUG, "API mcast failed count=%d (%s) (%d)",
 					count, SOCKERRMSG, (int)mcast_sock);
 					count, SOCKERRMSG, (int)mcast_sock);