From 43837929695c1682cb0c4d365e2c64402d8e0843 Mon Sep 17 00:00:00 2001 From: Stefan Ritt Date: Fri, 16 Dec 2016 09:54:54 +0100 Subject: [PATCH] Fixed crash with strlcpy when source and destination overlap --- src/elogd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/elogd.c b/src/elogd.c index 5b26235c..c9250393 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -18616,7 +18616,7 @@ char *param_in_str(char *str, char *param) BOOL subst_param(char *str, int size, char *param, char *value) { int len; - char *p1, *p2, *s, param_enc[256]; + char *p1, *p2, *s, param_enc[256], str2[256]; strlcpy(param_enc, param, sizeof(param_enc)); url_slash_encode(param_enc, sizeof(param_enc)); @@ -18658,14 +18658,16 @@ BOOL subst_param(char *str, int size, char *param, char *value) len = p2 - p1; if (len > (int) strlen(value)) { /* new value is shorter than old one */ - strlcpy(p1, value, size - (p1 - str)); - strlcpy(p1 + strlen(value), p2, size - (p1 + strlen(value) - str)); + strlcpy(str2, value, size - (p1 - str)); + strlcpy(str2 + strlen(value), p2, size - (p1 + strlen(value) - str)); + strlcpy(p1, str2, size - (p1 - str)); } else { /* new value is longer than old one */ s = (char *) xmalloc(size); strlcpy(s, p2, size); - strlcpy(p1, value, size - (p1 - str)); - strlcat(p1, s, size - (p1 + strlen(value) - str)); + strlcpy(str2, value, size - (p1 - str)); + strlcat(str2, s, size - (p1 + strlen(value) - str)); + strlcpy(p1, str2, size - (p1 - str)); xfree(s); }