We're currently type-casting the output of strlen(sdpdata->val.str) into an int, which is somewhat problematic given that strlen() can return values larger than sizeof(int). We can do better here and use size_t instead, so let's do that. While at it, also add a comment explaining why the check here is "smaller than" instead of "smaller than or equal". Co-developed-by: Zander Brown <zbrown@xxxxxxxxx> --- lib/sdp.c | 5 +++-- lib/sdp_lib.h | 14 +++++++------- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/lib/sdp.c b/lib/sdp.c index 4b10d8f67..cff7e09fb 100644 --- a/lib/sdp.c +++ b/lib/sdp.c @@ -2180,13 +2180,14 @@ int sdp_get_int_attr(const sdp_record_t *rec, uint16_t attrid, int *value) } int sdp_get_string_attr(const sdp_record_t *rec, uint16_t attrid, char *value, - int valuelen) + size_t valuelen) { sdp_data_t *sdpdata = sdp_data_get(rec, attrid); if (sdpdata) /* Verify that it is what the caller expects */ if (SDP_IS_TEXT_STR(sdpdata->dtd)) - if ((int) strlen(sdpdata->val.str) < valuelen) { + /* Have to copy the NULL terminator too, so check len < valuelen */ + if (strlen(sdpdata->val.str) < valuelen) { strcpy(value, sdpdata->val.str); return 0; } diff --git a/lib/sdp_lib.h b/lib/sdp_lib.h index 22776b678..91d46f59d 100644 --- a/lib/sdp_lib.h +++ b/lib/sdp_lib.h @@ -141,7 +141,7 @@ int sdp_general_inquiry(inquiry_info *ii, int dev_num, int duration, uint8_t *fo /* flexible extraction of basic attributes - Jean II */ int sdp_get_int_attr(const sdp_record_t *rec, uint16_t attr, int *value); -int sdp_get_string_attr(const sdp_record_t *rec, uint16_t attr, char *value, int valuelen); +int sdp_get_string_attr(const sdp_record_t *rec, uint16_t attr, char *value, size_t valuelen); /* * Basic sdp data functions @@ -543,32 +543,32 @@ int sdp_get_service_avail(const sdp_record_t *rec, uint8_t *svcAvail); int sdp_get_service_ttl(const sdp_record_t *rec, uint32_t *svcTTLInfo); int sdp_get_database_state(const sdp_record_t *rec, uint32_t *svcDBState); -static inline int sdp_get_service_name(const sdp_record_t *rec, char *str, int len) +static inline int sdp_get_service_name(const sdp_record_t *rec, char *str, size_t len) { return sdp_get_string_attr(rec, SDP_ATTR_SVCNAME_PRIMARY, str, len); } -static inline int sdp_get_service_desc(const sdp_record_t *rec, char *str, int len) +static inline int sdp_get_service_desc(const sdp_record_t *rec, char *str, size_t len) { return sdp_get_string_attr(rec, SDP_ATTR_SVCDESC_PRIMARY, str, len); } -static inline int sdp_get_provider_name(const sdp_record_t *rec, char *str, int len) +static inline int sdp_get_provider_name(const sdp_record_t *rec, char *str, size_t len) { return sdp_get_string_attr(rec, SDP_ATTR_PROVNAME_PRIMARY, str, len); } -static inline int sdp_get_doc_url(const sdp_record_t *rec, char *str, int len) +static inline int sdp_get_doc_url(const sdp_record_t *rec, char *str, size_t len) { return sdp_get_string_attr(rec, SDP_ATTR_DOC_URL, str, len); } -static inline int sdp_get_clnt_exec_url(const sdp_record_t *rec, char *str, int len) +static inline int sdp_get_clnt_exec_url(const sdp_record_t *rec, char *str, size_t len) { return sdp_get_string_attr(rec, SDP_ATTR_CLNT_EXEC_URL, str, len); } -static inline int sdp_get_icon_url(const sdp_record_t *rec, char *str, int len) +static inline int sdp_get_icon_url(const sdp_record_t *rec, char *str, size_t len) { return sdp_get_string_attr(rec, SDP_ATTR_ICON_URL, str, len); } -- 2.41.0