[Freeciv-Dev] (PR#9948) potential buffer overread in dataio

["Jason Short" <jdorje@xxxxxxxxxxxxxxxxxxxxx>]

<URL: http://rt.freeciv.org/Ticket/Display.html?id=9948 >

In dio_get_string:

   for (offset = 0; c[offset] != '\0' && offset < remaining; offset++) {

the conditional is wrong.  If we ever do hit the limit then the read 
will be on invalid memory before the second check tells us that we've 
gone too far.  These conditions should be reversed.

jason

Index: common/dataio.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/common/dataio.c,v
retrieving revision 1.12
diff -u -r1.12 dataio.c
--- common/dataio.c     2 Sep 2004 22:01:51 -0000       1.12
+++ common/dataio.c     5 Sep 2004 07:26:50 -0000
@@ -543,7 +543,7 @@
   c = ADD_TO_POINTER(din->src, din->current);
 
   /* avoid using strlen (or strcpy) on an (unsigned char*)  --dwp */
-  for (offset = 0; c[offset] != '\0' && offset < remaining; offset++) {
+  for (offset = 0; offset < remaining && c[offset] != '\0'; offset++) {
     /* nothing */
   }