The following memcpy() in buffer_entry.c is incorrect:
cmph_uint32 * keylen
[...]
memcpy(keylen + copied_bytes, buffer_entry->buff + buffer_entry->pos, (size_t)lacked_bytes);
Because cmph_uint32 has a length of 4 bytes, pointer arithmetic adds 4 bytes at a time, whereas copied_bytes is measured in bytes.
When copied_bytes is non-zero, the destination address for the memcpy is wrong resulting in stack corruption.
Therefore, it should be
memcpy((cmph_uint8 *)keylen + copied_bytes, buffer_entry->buff + buffer_entry->pos, (size_t)lacked_bytes);
It seems to be wrong in all branches.
The following
memcpy()inbuffer_entry.cis incorrect:cmph_uint32 * keylen[...]memcpy(keylen + copied_bytes, buffer_entry->buff + buffer_entry->pos, (size_t)lacked_bytes);Because
cmph_uint32has a length of 4 bytes, pointer arithmetic adds 4 bytes at a time, whereascopied_bytesis measured in bytes.When
copied_bytesis non-zero, the destination address for thememcpyis wrong resulting in stack corruption.Therefore, it should be
memcpy((cmph_uint8 *)keylen + copied_bytes, buffer_entry->buff + buffer_entry->pos, (size_t)lacked_bytes);It seems to be wrong in all branches.