FAQ

[memcached] plindner, r501: fix potential bug with memcpy(), use in ...

Commits
Apr 12, 2007 at 8:03 pm
fix potential bug with memcpy(), use in two more places

U trunk/server/items.c
U trunk/server/memcached.c


Modified: trunk/server/items.c
===================================================================
--- trunk/server/items.c 2007-04-12 20:02:46 UTC (rev 500)
+++ trunk/server/items.c 2007-04-12 20:03:15 UTC (rev 501)
@@ -272,7 +272,7 @@
it = it->next;
}

- strcpy(buffer + bufcurr, "END\r\n");
+ memcpy(buffer + bufcurr, "END\r\n", 6);
bufcurr += 5;

*bytes = bufcurr;
@@ -294,7 +294,7 @@
bufcurr += snprintf(bufcurr, (size_t)buflen, "STAT items:%d:number %u\r\nSTAT items:%d:age %u\r\n",
i, sizes[i], i, now - tails[i]->time);
}
- strcpy(bufcurr, "END");
+ memcpy(bufcurr, "END", 4);
return;
}


Modified: trunk/server/memcached.c
===================================================================
--- trunk/server/memcached.c 2007-04-12 20:02:46 UTC (rev 500)
+++ trunk/server/memcached.c 2007-04-12 20:03:15 UTC (rev 501)
@@ -670,7 +670,7 @@
}

memcpy(c->wbuf, str, len);
- memcpy(c->wbuf + len, "\r\n", 2);
+ memcpy(c->wbuf + len, "\r\n", 3);
c->wbytes = len + 2;
c->wcurr = c->wbuf;

@@ -925,7 +925,7 @@
free(wbuf); close(fd);
return;
}
- strcpy(wbuf + res, "END\r\n");
+ memcpy(wbuf + res, "END\r\n", 6);
c->write_and_free = wbuf;
c->wcurr = wbuf;
c->wbytes = res + 5; // Don't write the terminal '\0'
@@ -1241,7 +1241,7 @@
return;
}
memcpy(ITEM_data(new_it), temp, res);
- memcpy(ITEM_data(new_it) + res, "\r\n", 2);
+ memcpy(ITEM_data(new_it) + res, "\r\n", 3);
item_replace(it, new_it);
} else { /* replace in-place */
memcpy(ITEM_data(it), temp, res);
reply

Search Discussions

Discussion Navigation
viewthread | post

1 user in discussion

Commits: 1 post