[PATCH] fix overflow on script_dec (#2052)

Gbp-Pq: Name CVE-2022-24578.patch

diff --git a/src/bifs/script_dec.c b/src/bifs/script_dec.c
index cc6794aad3553cb9df62ca6d9a889e3260860522..fe0fd087baa1e279a08345fc84e643d5ed819023 100644 (file)
--- a/src/bifs/script_dec.c
+++ b/src/bifs/script_dec.c
@@ -73,13 +73,13 @@ static void SFS_AddString(ScriptParser *parser, char *str)
        char *new_str;
        if (!str) return;
        if (strlen(parser->string) + strlen(str) >= parser->length) {
-               parser->length += PARSER_STEP_ALLOC;
+               parser->length = strlen(parser->string) + strlen(str) + PARSER_STEP_ALLOC;
                new_str = (char *)gf_malloc(sizeof(char)*parser->length);
                strcpy(new_str, parser->string);
                gf_free(parser->string);
                parser->string = new_str;
        }
-       strcat(parser->string, str);
+       strncat(parser->string, str, parser->length - strlen(parser->string) - 1);
 }
 
 static void SFS_AddInt(ScriptParser *parser, s32 val)