Possible overflow in http_client.c

[openlink]

Possible overflow in http_client.c

[creffett]

I suspect that this is a null-terminator issue. The line in question is strncat ((char*)socksreq + 8, name, sizeof(socksreq) - 8);. In short, that will start at the 8th byte of socksreq, and append the characters of name to it, up to a maximum of sizeof(socksreq)-8, which should be the end of the string. Problem is, if you do have >=socksreq-8 characters in name, then there will be no room in socksreq for the null terminator for the string, and this causes the potential buffer overflow. Relevant section of the man page: "If src contains n or more characters, strncat() writes n+1 characters to dest (n from src plus the terminating null byte). Therefore, the size of dest must be at least strlen(dest)+n+1." So changing sizeof(socksreq)-8 to sizeof(socksreq)-9 should be sufficient to fix it.

[openlink]

will be part of the 6.1.6 release of VOS