Commit 85bd4621 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

Prevent a very long password to buffer overflow the global variable we 

use when built with a very old OpenSSL version.
parent 6c3759d7

lib/ssluse.c

+3 −1
Original line number Diff line number Diff line
@@ -261,7 +261,9 @@ int cert_stuff(struct connectdata *conn, 
       * If password has been given, we store that in the global

       * area (*shudder*) for a while:

       */

      strcpy(global_passwd, data->set.key_passwd);

      size_t len = strlen(data->set.key_passwd);

      if(len < sizeof(global_passwd))

        memcpy(global_passwd, data->set.key_passwd, len+1);

#else

      /*

       * We set the password in the callback userdata