From: Jon Trulson <jon@radscan.com>
Date: Sun, 27 May 2012 00:29:26 +0000 (-0600)
Subject: tt_isam_record.C: fix CERT VU#387387 part 2
X-Git-Tag: 2.2.0a~26^2~35
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=95e6fd42cce91fe86eef397083ffcecdc540169e;p=oweals%2Fcde.git

tt_isam_record.C: fix CERT VU#387387 part 2
---

diff --git a/cde/lib/tt/bin/ttdbserverd/tt_isam_record.C b/cde/lib/tt/bin/ttdbserverd/tt_isam_record.C
index 75c18b91..5d635e2e 100644
--- a/cde/lib/tt/bin/ttdbserverd/tt_isam_record.C
+++ b/cde/lib/tt/bin/ttdbserverd/tt_isam_record.C
@@ -159,5 +159,18 @@ void _Tt_isam_record::setBytes (int               start,
 				int               length,
 				const _Tt_string &value)
 {
-  (void)memcpy((char *)buffer+start, (char *)value, length);
+  // JET - CERT vulnerability: VU#387387 - value is user supplied.
+  // Geez.
+  int bavail = (maxLength - start);
+  int bcp = 0;
+
+  if (bavail <= 0)
+    return;
+
+  if (bavail > length)
+    bcp = length;
+  else
+    bcp = bavail;
+
+  (void)memcpy((char *)buffer+start, (char *)value, bcp);
 }