Prevent memory corruption during ACLK OTP decode (#18863)
Allocate large enough buffer to prevent buffer overrun
Stelios Fragkakis committed
Oct 24, 2024 at 22:28 UTC
dcdd994bfa928c24aea6ab6fe1988cf4b3abd1e1
1 file changed
+1
-1
src/aclk/aclk_otp.c
+1
-1
@@ -324,7 +324,7 @@ int aclk_get_otp_challenge(url_t *target, const char *agent_id, unsigned char **
324
goto cleanup_json;
325
}
326
327
- *challenge = mallocz(CHALLENGE_LEN);
327
+ *challenge = mallocz((CHALLENGE_LEN_BASE64 / 4) * 3 + 1);
328
*challenge_bytes = netdata_base64_decode(*challenge, (const unsigned char *) challenge_base64, CHALLENGE_LEN_BASE64);
329
330
if (*challenge_bytes != CHALLENGE_LEN) {