From 888e1e74012a4d17bb56ef3d2be2dd6d635c449b Mon Sep 17 00:00:00 2001 From: JunsuChoi Date: Mon, 2 Nov 2020 13:05:44 +0900 Subject: [PATCH] vg_load_svg: Prevent memory overflow for tag_name Summary: When copying tag_name, if length of referenced string is longer than general case, it is not used as tag_name. Test Plan: N/A Reviewers: Hermet, smohanty Reviewed By: Hermet Subscribers: kimcinoo, herb, cedric, #committers, #reviewers Tags: #efl Differential Revision: https://phab.enlightenment.org/D12185 --- src/modules/evas/vg_loaders/svg/evas_vg_load_svg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/modules/evas/vg_loaders/svg/evas_vg_load_svg.c b/src/modules/evas/vg_loaders/svg/evas_vg_load_svg.c index e68edbb0c9..e8c46ceb1f 100644 --- a/src/modules/evas/vg_loaders/svg/evas_vg_load_svg.c +++ b/src/modules/evas/vg_loaders/svg/evas_vg_load_svg.c @@ -2279,6 +2279,7 @@ _evas_svg_loader_xml_open_parser(Evas_SVG_Loader *loader, attrs_length = length - sz; while ((sz > 0) && (isspace(content[sz - 1]))) sz--; + if ((unsigned int)sz > sizeof(tag_name)) return; strncpy(tag_name, content, sz); tag_name[sz] = '\0'; }