From 931ec2370228e40309af51b86e10fa364a37a20e Mon Sep 17 00:00:00 2001 From: Azat Khuzhin Date: Sun, 28 Oct 2018 16:46:24 +0300 Subject: [PATCH] Convert evbuffer_strspn() (internal helper) to use size_t As pointed by @yankeehacker in #590: Signed to Unsigned Conversion Error - buffer.c:1623 Description: This assignment creates a type mismatch by populating an unsigned variable with a signed value. The signed integer will be implicitly cast to an unsigned integer, converting negative values into positive ones. If an attacker can control the signed value, it may be possible to trigger a buffer overflow if the value specifies the length of a memory write. Remediation: Do not rely on implicit casts between signed and unsigned values because the result can take on an unexpected value and violate weak assumptions made elsewhere in the program. Fixes: #590 --- buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/buffer.c b/buffer.c index 25a6e528..f6ff8431 100644 --- a/buffer.c +++ b/buffer.c @@ -1535,11 +1535,11 @@ evbuffer_find_eol_char(struct evbuffer_ptr *it) return (-1); } -static inline int +static inline size_t evbuffer_strspn( struct evbuffer_ptr *ptr, const char *chrset) { - int count = 0; + size_t count = 0; struct evbuffer_chain *chain = ptr->internal_.chain; size_t i = ptr->internal_.pos_in_chain; -- 2.40.0