summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRoss Burton <ross.burton@intel.com>2012-07-18 09:37:38 (GMT)
committerDaniel Wagner <daniel.wagner@bmw-carit.de>2012-07-18 09:52:16 (GMT)
commitc28f8256ca105da2d3b1f47a3a348fa47e7d89c6 (patch)
tree448eae14222a70326f41ef9cd96b64bca5175c70
parent13f39a7a5b21c7088d584e015f44cad88def279b (diff)
downloadconnman-c28f8256ca105da2d3b1f47a3a348fa47e7d89c6.zip
connman-c28f8256ca105da2d3b1f47a3a348fa47e7d89c6.tar.gz
connman-c28f8256ca105da2d3b1f47a3a348fa47e7d89c6.tar.bz2
storage: check that the string isn't empty before splitting
If the string was non-NULL but empty (str="\0"), the following \0 assignment would write to str[-1] and thus cause memory corruption. On PPC and MIPS, this was causing crashes in glibc.
-rw-r--r--src/storage.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/src/storage.c b/src/storage.c
index 47bd0cb..20766a3 100644
--- a/src/storage.c
+++ b/src/storage.c
@@ -212,7 +212,11 @@ gchar **connman_storage_get_services()
closedir(dir);
str = g_string_free(result, FALSE);
- if (str) {
+ if (str && str[0] != '\0') {
+ /*
+ * Remove the trailing separator so that services doesn't end up
+ * with an empty element.
+ */
str[strlen(str) - 1] = '\0';
services = g_strsplit(str, "/", -1);
}