Skip to content
This repository was archived by the owner on Jan 23, 2023. It is now read-only.

Commit dea615b

Browse files
omajidjkotas
authored andcommitted
Null-terminate buffers that strncpy writes to (#24095)
It is possible that the string being copied is so large that strncpy fills up the destination array and does not write any null characters to it. That will lead to buffer overflows. Work around that by always writing a null character at the end of the destination array.
1 parent 37957f4 commit dea615b

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

src/corefx/System.Globalization.Native/pal_calendarData.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,8 @@ static int32_t EnumSymbols(const char* locale,
305305

306306
char localeWithCalendarName[ULOC_FULLNAME_CAPACITY];
307307
strncpy(localeWithCalendarName, locale, ULOC_FULLNAME_CAPACITY);
308+
localeWithCalendarName[ULOC_FULLNAME_CAPACITY - 1] = 0;
309+
308310
uloc_setKeywordValue("calendar", GetCalendarName(calendarId), localeWithCalendarName, ULOC_FULLNAME_CAPACITY, &err);
309311

310312
UCalendar* pCalendar = ucal_open(NULL, 0, localeWithCalendarName, UCAL_DEFAULT, &err);
@@ -412,6 +414,7 @@ static int32_t EnumAbbrevEraNames(const char* locale,
412414
char* parentNamePtr = parentNameBuf;
413415

414416
strncpy(localeNamePtr, locale, ULOC_FULLNAME_CAPACITY);
417+
localeNamePtr[ULOC_FULLNAME_CAPACITY - 1] = 0;
415418

416419
while (TRUE)
417420
{

0 commit comments

Comments
 (0)