linebuf: Fix possible memory corruption when receiving many CR/LF.

The last byte of balloc.c's block pointer could be changed from 10 or 13 to
0. On amd64, this is not possible. On i386, this is possible and usually
causes a crash soon.

diff --git a/libratbox/src/linebuf.c b/libratbox/src/linebuf.c
index 782e183130a0132f18d7ec4cb8704dd8ae84a22c..ca3440ba5f9fe0c51a85430b6806a3b37d87fa74 100644 (file)
--- a/libratbox/src/linebuf.c
+++ b/libratbox/src/linebuf.c
@@ -224,7 +224,8 @@ rb_linebuf_copy_line(buf_head_t * bufhead, buf_line_t * bufline, char *data, int
        /* This is the ~overflow case..This doesn't happen often.. */
        if(cpylen > (BUF_DATA_SIZE - bufline->len - 1))
        {
-               memcpy(bufch, ch, (BUF_DATA_SIZE - bufline->len - 1));
+               cpylen = BUF_DATA_SIZE - bufline->len - 1;
+               memcpy(bufch, ch, cpylen);
                bufline->buf[BUF_DATA_SIZE - 1] = '\0';
                bufch = bufline->buf + BUF_DATA_SIZE - 2;
                while(cpylen && (*bufch == '\r' || *bufch == '\n'))