[or-cvs] point out some bugs for nick, noticed by whiteout

[arma at seul.org]

Update of /home2/or/cvsroot/tor/src/or
In directory moria:/home/arma/work/onion/cvs/tor/src/or

Modified Files:
	control.c 
Log Message:
point out some bugs for nick, noticed by whiteout


Index: control.c
===================================================================
RCS file: /home2/or/cvsroot/tor/src/or/control.c,v
retrieving revision 1.101
retrieving revision 1.102
diff -u -d -r1.101 -r1.102
--- control.c	13 Jul 2005 05:14:42 -0000	1.101
+++ control.c	15 Jul 2005 18:48:38 -0000	1.102
@@ -315,11 +315,12 @@
 
   *out = outp = tor_malloc(len);
 
-  while (len) {
+  while (len) { /* XXX: len never changes during the loop? */
     if (*data == '.')
       ++data;
     if (translate_newlines)
       next = tor_memmem(data, len, "\r\n", 2);
+      /* XXX: as data increases, we're reading past our allowed buffer! */
     else
       next = tor_memmem(data, len, "\r\n.", 3);
     if (next) {
@@ -327,7 +328,7 @@
       outp += (next-data);
       data = next+2;
     } else {
-      memcpy(outp, data, len);
+      memcpy(outp, data, len); /* len is constant. scribbling from past *out. */
       outp += len;
       return outp - *out;
     }