From dcd744392b5a51d2e2de2d68d7180d25e2ec5940 Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@openldap.org>
Date: Sun, 19 Feb 2012 18:10:16 -0800
Subject: [PATCH] ITS#7174 lutil_str2bin: can't modify input strings

---
 libraries/liblutil/utils.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/libraries/liblutil/utils.c b/libraries/liblutil/utils.c
index ce2e1d08fc..6ed4c6bb04 100644
--- a/libraries/liblutil/utils.c
+++ b/libraries/liblutil/utils.c
@@ -714,8 +714,6 @@ scale( int new, lutil_int_decnum *prev, unsigned char *tmp )
  * Output buffer must be provided, bv_len must indicate buffer size
  * Hex input can be "0x1234" or "'1234'H"
  *
- * Temporarily modifies the input string.
- *
  * Note: High bit of binary form is always the sign bit. If the number
  * is supposed to be positive but has the high bit set, a zero byte
  * is prepended. It is assumed that this has already been handled on
@@ -724,7 +722,7 @@ scale( int new, lutil_int_decnum *prev, unsigned char *tmp )
 int
 lutil_str2bin( struct berval *in, struct berval *out, void *ctx )
 {
-	char *pin, *pout, ctmp;
+	char *pin, *pout;
 	char *end;
 	int i, chunk, len, rc = 0, hex = 0;
 	if ( !out || !out->bv_val || out->bv_len < in->bv_len )
@@ -749,6 +747,8 @@ lutil_str2bin( struct berval *in, struct berval *out, void *ctx )
 	if ( hex ) {
 #define HEXMAX	(2 * sizeof(long))
 		unsigned long l;
+		char tbuf[HEXMAX+1];
+
 		/* Convert a longword at a time, but handle leading
 		 * odd bytes first
 		 */
@@ -758,11 +758,10 @@ lutil_str2bin( struct berval *in, struct berval *out, void *ctx )
 
 		while ( len ) {
 			int ochunk;
-			ctmp = pin[chunk];
-			pin[chunk] = '\0';
+			memcpy( tbuf, pin, chunk );
+			tbuf[chunk] = '\0';
 			errno = 0;
-			l = strtoul( pin, &end, 16 );
-			pin[chunk] = ctmp;
+			l = strtoul( tbuf, &end, 16 );
 			if ( errno )
 				return -1;
 			ochunk = (chunk + 1)/2;
@@ -778,10 +777,12 @@ lutil_str2bin( struct berval *in, struct berval *out, void *ctx )
 		out->bv_len = pout - out->bv_val;
 	} else {
 	/* Decimal */
+#define	DECMAX	8	/* 8 digits at a time */
 		char tmpbuf[64], *tmp;
 		lutil_int_decnum num;
 		int neg = 0;
 		long l;
+		char tbuf[DECMAX+1];
 
 		len = in->bv_len;
 		pin = in->bv_val;
@@ -795,8 +796,6 @@ lutil_str2bin( struct berval *in, struct berval *out, void *ctx )
 			pin++;
 		}
 
-#define	DECMAX	8	/* 8 digits at a time */
-
 		/* tmp must be at least as large as outbuf */
 		if ( out->bv_len > sizeof(tmpbuf)) {
 			tmp = ber_memalloc_x( out->bv_len, ctx );
@@ -808,11 +807,10 @@ lutil_str2bin( struct berval *in, struct berval *out, void *ctx )
 			chunk = DECMAX;
 
 		while ( len ) {
-			ctmp = pin[chunk];
-			pin[chunk] = '\0';
+			memcpy( tbuf, pin, chunk );
+			tbuf[chunk] = '\0';
 			errno = 0;
-			l = strtol( pin, &end, 10 );
-			pin[chunk] = ctmp;
+			l = strtol( tbuf, &end, 10 );
 			if ( errno ) {
 				rc = -1;
 				goto decfail;
-- 
2.39.5