From: red-001 <red-001@outlook.ie>
Date: Tue, 26 Jun 2018 08:02:26 +0000 (+0100)
Subject: Fix buffer overrun in SRP (#7484)
X-Git-Tag: 5.0.0~335
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=7bdf5eae05f63a98a13e520f98e68b9e7d9d544b;p=oweals%2Fminetest.git

Fix buffer overrun in SRP (#7484)

The old code got a pointer to the array instead of the first element, this resulted in a buffer overflow when the function was used more than once.
---

diff --git a/src/util/srp.cpp b/src/util/srp.cpp
index 9aed9eb0c..a3452e022 100644
--- a/src/util/srp.cpp
+++ b/src/util/srp.cpp
@@ -613,7 +613,7 @@ SRP_Result srp_create_salted_verification_key( SRP_HashAlgorithm alg,
 			if (fill_buff() != SRP_OK) goto error_and_exit;
 		*bytes_s = (unsigned char *)srp_alloc(size_to_fill);
 		if (!*bytes_s) goto error_and_exit;
-		memcpy(*bytes_s, &g_rand_buff + g_rand_idx, size_to_fill);
+		memcpy(*bytes_s, &g_rand_buff[g_rand_idx], size_to_fill);
 		g_rand_idx += size_to_fill;
 	}