Commit e6b0fbf6 authored by kmarshall's avatar kmarshall Committed by Commit bot

Fix buffer overflow due to unbounded strlen over the non-null terminated audio...

Fix buffer overflow due to unbounded strlen over the non-null terminated audio policy string. Caught by asan.

BUG=

Review URL: https://codereview.chromium.org/890683002

Cr-Commit-Position: refs/heads/master@{#314019}
parent 5500d58b
...@@ -137,8 +137,11 @@ AuthResult AuthenticateChallengeReply(const CastMessage& challenge_reply, ...@@ -137,8 +137,11 @@ AuthResult AuthenticateChallengeReply(const CastMessage& challenge_reply,
return result; return result;
} }
if (response.client_auth_certificate().find(reinterpret_cast<const char*>( const std::string& audio_policy =
kAudioOnlyPolicy)) != std::string::npos) { std::string(reinterpret_cast<const char*>(kAudioOnlyPolicy),
(arraysize(kAudioOnlyPolicy) / sizeof(unsigned char)));
if (response.client_auth_certificate().find(audio_policy) !=
std::string::npos) {
result.channel_policies |= AuthResult::POLICY_AUDIO_ONLY; result.channel_policies |= AuthResult::POLICY_AUDIO_ONLY;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment