From c868b6ac0bf17b82c1c5c6f601928742389d1aa4 Mon Sep 17 00:00:00 2001 From: aaptel Date: Thu, 10 Mar 2016 10:51:58 +0100 Subject: [PATCH] lib/gssapi/mech/gss_compare_name.c: fix memcmp() call Make memcmp() compare the name1 and name2 value instead of comparing name1 with itself. The memcmp() is only executed if the left-hand side of the || is false i.e. when both length are equal so the length argument is correct (no out-of-bounds reads). --- lib/gssapi/mech/gss_compare_name.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/gssapi/mech/gss_compare_name.c b/lib/gssapi/mech/gss_compare_name.c index 8e5659281..18a8536ab 100644 --- a/lib/gssapi/mech/gss_compare_name.c +++ b/lib/gssapi/mech/gss_compare_name.c @@ -47,7 +47,7 @@ gss_compare_name(OM_uint32 *minor_status, if (!gss_oid_equal(&name1->gn_type, &name2->gn_type)) { *name_equal = 0; } else if (name1->gn_value.length != name2->gn_value.length || - memcmp(name1->gn_value.value, name1->gn_value.value, + memcmp(name1->gn_value.value, name2->gn_value.value, name1->gn_value.length)) { *name_equal = 0; }