From ce82a87d04e54288137bdeed6c53b378e5350577 Mon Sep 17 00:00:00 2001
From: Kern Sibbald <kern@sibbald.com>
Date: Mon, 18 Jan 2010 09:26:39 +0100
Subject: [PATCH] Keep serial from overruning with bad data

---
 bacula/src/lib/serial.c | 34 +++++++++++++++++++++-------------
 bacula/src/lib/serial.h | 11 +++++------
 2 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/bacula/src/lib/serial.c b/bacula/src/lib/serial.c
index 6b803f16db..2de4edaf30 100644
--- a/bacula/src/lib/serial.c
+++ b/bacula/src/lib/serial.c
@@ -2,14 +2,11 @@
 
                    Serialisation Support Functions
                           John Walker
-
-
-     Version $Id$
 */
 /*
    Bacula® - The Network Backup Solution
 
-   Copyright (C) 2000-2006 Free Software Foundation Europe e.V.
+   Copyright (C) 2000-2010 Free Software Foundation Europe e.V.
 
    The main author of Bacula is Kern Sibbald, with contributions from
    many others, a complete list can be found in the file AUTHORS.
@@ -173,12 +170,17 @@ void serial_float64(uint8_t * * const ptr, const float64_t v)
     *ptr += sizeof(float64_t);
 }
 
-void serial_string(uint8_t * * const ptr, const char * const str)
+void serial_string(uint8_t * * const ptr, const char * const str, int max)
 {
-   int len = strlen(str) + 1;
-
-   memcpy(*ptr, str, len);
-   *ptr += len;
+   int i;                   
+   char *dest = (char *)*ptr;
+   char *src = (char *)str;
+   for (i=0; i<max && src[i] != 0;  i++) {
+      dest[i] = src[i];
+   }
+   dest[i++] = 0;                  /* terminate output string */
+   *ptr += i;                      /* update pointer */
+// Dmsg2(000, "ser src=%s dest=%s\n", src, dest);
 }
 
 
@@ -302,9 +304,15 @@ float64_t unserial_float64(uint8_t * * const ptr)
     return v;
 }
 
-void unserial_string(uint8_t * * const ptr, char * const str)
+void unserial_string(uint8_t * * const ptr, char * const str, int max)
 {
-   int len = strlen((char *) *ptr) + 1;
-   memcpy(str, (char *) *ptr, len);
-   *ptr += len;
+   int i;                   
+   char *src = (char*)(*ptr);
+   char *dest = str;
+   for (i=0; i<max && src[i] != 0;  i++) {
+      dest[i] = src[i];
+   }
+   dest[i++] = 0;            /* terminate output string */
+   *ptr += i;                /* update pointer */
+// Dmsg2(000, "unser src=%s dest=%s\n", src, dest);
 }
diff --git a/bacula/src/lib/serial.h b/bacula/src/lib/serial.h
index 6151287543..44ab51ed20 100644
--- a/bacula/src/lib/serial.h
+++ b/bacula/src/lib/serial.h
@@ -1,7 +1,7 @@
 /*
    Bacula® - The Network Backup Solution
 
-   Copyright (C) 2000-2008 Free Software Foundation Europe e.V.
+   Copyright (C) 2000-2010 Free Software Foundation Europe e.V.
 
    The main author of Bacula is Kern Sibbald, with contributions from
    many others, a complete list can be found in the file AUTHORS.
@@ -29,7 +29,6 @@
  *
  * Written by John Walker, MM
  *
- *   Version $Id$
  */
 
 /*  Serialisation support functions from serial.c.  */
@@ -42,7 +41,7 @@ extern void serial_int64(uint8_t * * ptr, int64_t v);
 extern void serial_uint64(uint8_t * * const ptr, const uint64_t v);
 extern void serial_btime(uint8_t * * const ptr, const btime_t v);
 extern void serial_float64(uint8_t * * const ptr, const float64_t v);
-extern void serial_string(uint8_t * * const ptr, const char * const str);
+extern void serial_string(uint8_t * * const ptr, const char * const str, int max);
 
 extern int16_t unserial_int16(uint8_t * * const ptr);
 extern uint16_t unserial_uint16(uint8_t * * const ptr);
@@ -52,7 +51,7 @@ extern int64_t unserial_int64(uint8_t * * const ptr);
 extern uint64_t unserial_uint64(uint8_t * * const ptr);
 extern btime_t unserial_btime(uint8_t * * const ptr);
 extern float64_t unserial_float64(uint8_t * * const ptr);
-extern void unserial_string(uint8_t * * const ptr, char * const str);
+extern void unserial_string(uint8_t * * const ptr, char * const str, int max);
 
 /*
 
@@ -126,7 +125,7 @@ extern void unserial_string(uint8_t * * const ptr, char * const str);
 #define ser_buffer(x)   ser_bytes((x), (sizeof (x)))
 
 /* Binary string not requiring serialization */
-#define ser_string(x)   serial_string(&ser_ptr, (x))
+#define ser_string(x)   serial_string(&ser_ptr, (x), (int)sizeof(x))
 
 /*                         Unserialisation                  */
 
@@ -166,6 +165,6 @@ extern void unserial_string(uint8_t * * const ptr, char * const str);
 #define unser_buffer(x)  unser_bytes((x), (sizeof (x)))
 
 /* Binary string not requiring serialization */
-#define unser_string(x) unserial_string(&ser_ptr, (x))
+#define unser_string(x) unserial_string(&ser_ptr, (x), (int)sizeof(x))
 
 #endif /* __SERIAL_H_ */
-- 
2.39.5