lib: fix possible off-by-one in stream_put_prefix()
The STREAM_WRITEABLE() call only checks if there is space for the
prefix in the stream but does not account for the prefixlen. The
stream_putc() call reduces available space by 1 and we can end
copying one byte too much and with "endp" off by one if we are
near the buffer end.
Instead of moving the stream_putc() call before STREAM_WRITEABLE(),
we check before hand for the required space, and open-code it. This
avoids a function call and verifying again the stream buffer.
Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
diff --git a/lib/stream.c b/lib/stream.c
index ee2920e..ccd4623 100644
--- a/lib/stream.c
+++ b/lib/stream.c
@@ -700,13 +700,13 @@
psize = PSIZE (p->prefixlen);
- if (STREAM_WRITEABLE (s) < psize)
+ if (STREAM_WRITEABLE (s) < (psize + sizeof (u_char)))
{
STREAM_BOUND_WARN (s, "put");
return 0;
}
- stream_putc (s, p->prefixlen);
+ s->data[s->endp++] = p->prefixlen;
memcpy (s->data + s->endp, &p->u.prefix, psize);
s->endp += psize;