From: Jon Trulson <jon@radscan.com>
Date: Sun, 27 May 2012 00:28:02 +0000 (-0600)
Subject: tt_isam_record.C: fix CERT VU#387387
X-Git-Tag: 2.2.0a~26^2~36
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=e820f21540ae9d6ea03bf0e612b688b1c56fd298;p=oweals%2Fcde.git

tt_isam_record.C: fix CERT VU#387387
---

diff --git a/cde/lib/tt/bin/ttdbserverd/tt_isam_record.C b/cde/lib/tt/bin/ttdbserverd/tt_isam_record.C
index e5fceaba..75c18b91 100644
--- a/cde/lib/tt/bin/ttdbserverd/tt_isam_record.C
+++ b/cde/lib/tt/bin/ttdbserverd/tt_isam_record.C
@@ -139,7 +139,20 @@ _Tt_string _Tt_isam_record::getBytes (int start, int length) const
      
 void _Tt_isam_record::setBytes (int start, const _Tt_string &value)
 {
-  (void)memcpy((char *)buffer+start, (char *)value, value.len());
+  // JET - CERT vulnerability: VU#387387 - value is user supplied.
+  // Geez.
+  int bavail = (maxLength - start);
+  int bcp = 0;
+
+  if (bavail <= 0)
+    return;
+
+  if (bavail > length)
+    bcp = length;
+  else
+    bcp = bavail;
+
+  (void)memcpy((char *)buffer+start, (char *)value, bcp);
 }
 
 void _Tt_isam_record::setBytes (int               start,