From 2898a08efded09bc4070c488c1add725695417f9 Mon Sep 17 00:00:00 2001 From: Michael Zanetti Date: Tue, 15 Dec 2020 22:30:03 +0100 Subject: [PATCH] Fix memory off-by-one overflow --- libnymea-core/integrations/python/pynymealogginghandler.h | 5 ++--- libnymea-core/integrations/python/pystdouthandler.h | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/libnymea-core/integrations/python/pynymealogginghandler.h b/libnymea-core/integrations/python/pynymealogginghandler.h index fe2e8970..af11b1c0 100644 --- a/libnymea-core/integrations/python/pynymealogginghandler.h +++ b/libnymea-core/integrations/python/pynymealogginghandler.h @@ -28,8 +28,7 @@ static int PyNymeaLoggingHandler_init(PyNymeaLoggingHandler *self, PyObject *arg return -1; } - self->category = (char*)malloc(qstrlen(category)); - qstrcpy(self->category, category); + self->category = qstrdup(category); return 0; } @@ -37,7 +36,7 @@ static int PyNymeaLoggingHandler_init(PyNymeaLoggingHandler *self, PyObject *arg static void PyNymeaLoggingHandler_dealloc(PyNymeaLoggingHandler * self) { qCDebug(dcPythonIntegrations()) << "--- PyNymeaLoggingHandler"; - free(self->category); + delete[] self->category; Py_TYPE(self)->tp_free(self); } diff --git a/libnymea-core/integrations/python/pystdouthandler.h b/libnymea-core/integrations/python/pystdouthandler.h index 24d3fdba..8d7fee3f 100644 --- a/libnymea-core/integrations/python/pystdouthandler.h +++ b/libnymea-core/integrations/python/pystdouthandler.h @@ -30,9 +30,8 @@ static int PyStdOutHandler_init(PyStdOutHandler *self, PyObject *args, PyObject return -1; } - self->category = (char*)malloc(qstrlen(category)); + self->category = qstrdup(category); self->msgType = msgType; - qstrcpy(self->category, category); return 0; } @@ -40,7 +39,7 @@ static int PyStdOutHandler_init(PyStdOutHandler *self, PyObject *args, PyObject static void PyStdOutHandler_dealloc(PyStdOutHandler * self) { qCDebug(dcPythonIntegrations()) << "--- PyStdOutHandler"; - free(self->category); + delete[] self->category; Py_TYPE(self)->tp_free(self); }