romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 17:07:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

rustls: limit snprintf proper in cr_keylog_log_cb()

Browse source 
It should limit the size to the size of the target array, not the
incoming data.

Pointed out by ZeroPath
Closes #19095
This commit is contained in:
Daniel Stenberg 2025-10-17 11:24:36 +02:00
parent 3a305831d1
commit c4db9eb491
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/vtls/rustls.c
View file

@ -518,7 +518,7 @@ cr_keylog_log_cb(struct rustls_str label,
(void)client_random_len;
DEBUGASSERT(client_random_len == CLIENT_RANDOM_SIZE);
/* Turning a "rustls_str" into a null delimited "c" string */
curl_msnprintf(clabel, label.len + 1, "%.*s", (int)label.len, label.data);
curl_msnprintf(clabel, sizeof(clabel), "%.*s", (int)label.len, label.data);
Curl_tls_keylog_write(clabel, client_random, secret, secret_len);
}