wikimedia/varnishkafka — pull request #3 by Stype (2014-04-17 17:34:35+00:00)
Title: Check assumptions, fix heap overflow

I was looking at the security of varnishkafka, and had a couple of hardening asserts (just to make future reviews easier). Also, it looks like string_replace_arr wasn't quite right-- it used the same from and to for each iteration of the replacement array. There were also two ways the write past the allocated buffer length in that function. Neither are exploitable, but seem like good things to fix.

* Whenever the difference of tolen and fromlen is smaller than the tolen, then the check to see if there is enough allocated space in the buffer fails. e.g.,
char *replace[] = {
"a", "12345678901234567890",
"c", "AAAAAAAAAAAAAAAAAAA",
"bbbbbbbb", "OVERFLO", //diff will be -1
NULL, NULL
};
format = string_replace_arr("aaaaaaacbbbbbbbb", replace);

* The buffer size wasn't checked before writing the remainder of the string to the output buffer
char *replace[] = {
"a", "12345678901234567890",
NULL, NULL
};
format = string_replace_arr("aaaaaaaaOVERFLOW", replace);