儲存庫 vbox 的更動 63262

時間撮記:

2016-8-10 下午01:09:42 (8 年 以前)

作者:

vboxsync

訊息:

Config.cpp: Impossible buffer overlow. warnings

檔案:

• trunk/src/VBox/NetworkServices/DHCP/Config.cpp (修改) (7 筆差異)

trunk/src/VBox/NetworkServices/DHCP/Config.cpp

@@ -85 +85 @@
 int BaseConfigEntity::match(Client& client, BaseConfigEntity **cfg)
 {
-    int iMatch = (m_criteria && m_criteria->check(client)? m_MatchLevel: 0);
+    int iMatch = (m_criteria && m_criteria->check(client) ? m_MatchLevel : 0);
     if (m_children.empty())
     {
@@ -238 +238 @@
             Client c(data);
             int rc = g_RootConfig->match(c, (BaseConfigEntity **)&pNetCfg);
-            Assert(rc >= 0 && pNetCfg);
+            Assert(rc >= 0 && pNetCfg); RT_NOREF(rc);
 
             l.setConfig(pNetCfg);
@@ -358 +358 @@
      * Search the vendor field.
      */
-    bool            fExtended = false;
     uint8_t const  *pb = &pDhcpMsg->bp_vend.Dhcp.dhcp_opts[0];
     while (pb && cbLeft > 0)
@@ -372 +371 @@
         else
         {
-            size_t cbCur = pb[1];
+            uint8_t cbCur = pb[1];
             if (cbCur > cbLeft - 2)
-                cbCur = cbLeft - 2;
+                cbCur = (uint8_t)(cbLeft - 2);
             if (uCur == uOption)
             {
@@ -652 +651 @@
 
 
-const std::string& ConfigurationManager::getString(uint8_t u8OptId)
+const std::string &ConfigurationManager::getString(uint8_t u8OptId)
 {
     switch (u8OptId)
@@ -659 +658 @@
             if (m->m_domainName.length())
                 return m->m_domainName;
-            else
-                return m_noString;
+            return m_noString;
         default:
             break;
@@ -1204 +1202 @@
                     }
 
-                    char *pszDomainName = (char *)&opt.au8RawOpt[0];
-
-                    strcpy(pszDomainName, domainName.c_str());
-                    opt.cbRawOpt = domainName.length();
+                    size_t cchLength = domainName.length();
+                    if (cchLength >= sizeof(opt.au8RawOpt))
+                        cchLength = sizeof(opt.au8RawOpt) - 1;
+                    memcpy(&opt.au8RawOpt[0], domainName.c_str(), cchLength);
+                    opt.au8RawOpt[cchLength] = '\0';
+                    opt.cbRawOpt = (uint8_t)cchLength;
                 }
                 break;