Skip to content

Commit bdc71e5

Browse files
authored
Avoid reading past end of non-zero terminated char arrays (#8597)
1 parent 9ace4ed commit bdc71e5

File tree

1 file changed

+6
-3
lines changed

1 file changed

+6
-3
lines changed

Diff for: cores/esp8266/WString.cpp

+6-3
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,8 @@ String &String::copy(const char *cstr, unsigned int length) {
260260
return *this;
261261
}
262262
setLen(length);
263-
memmove_P(wbuffer(), cstr, length + 1);
263+
memmove_P(wbuffer(), cstr, length);
264+
wbuffer()[length] = 0;
264265
return *this;
265266
}
266267

@@ -270,7 +271,8 @@ String &String::copy(const __FlashStringHelper *pstr, unsigned int length) {
270271
return *this;
271272
}
272273
setLen(length);
273-
memcpy_P(wbuffer(), (PGM_P)pstr, length + 1); // We know wbuffer() cannot ever be in PROGMEM, so memcpy safe here
274+
memcpy_P(wbuffer(), (PGM_P)pstr, length); // We know wbuffer() cannot ever be in PROGMEM, so memcpy safe here
275+
wbuffer()[length] = 0;
274276
return *this;
275277
}
276278

@@ -411,8 +413,9 @@ bool String::concat(const __FlashStringHelper *str) {
411413
unsigned int newlen = len() + length;
412414
if (!reserve(newlen))
413415
return false;
414-
memcpy_P(wbuffer() + len(), (PGM_P)str, length + 1);
416+
memcpy_P(wbuffer() + len(), (PGM_P)str, length);
415417
setLen(newlen);
418+
wbuffer()[newlen] = 0;
416419
return true;
417420
}
418421

0 commit comments

Comments
 (0)