Xml_node: fix bug in Xml_node::decoded_content

Previously, the dst_len value was not decreased after each character that was
written to the dst buffer. This way, if the content length was greater than
dst_len, decoded_content wrote to memory out of bounds.

Issue #2644
This commit is contained in:
Martin Stein 2018-01-16 14:30:30 +01:00 committed by Norman Feske
parent 84e476facb
commit 26f65f4996

View File

@ -683,7 +683,7 @@ class Genode::Xml_node
char const *src = content_base();
size_t src_len = content_size();
for (; dst_len && src_len; result_len++) {
for (; dst_len && src_len; dst_len--, result_len++) {
Decoded_character const decoded_character(src, src_len);