commit 7c719b0db147085ffa42620b9ec403b9565f5fc2
author Johannes Kron <kron@webrtc.org> Thu Jun 17 08:37:22 2021
committer WebRTC LUCI CQ <webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Jun 18 14:07:28 2021
tree ebb8136f1eb4003542a2b83a515e38b5a6ad0b13
parent bad0ab085899b42e85e5c6c6a6d98db7a58de382

Fixes off-by-one error in video capture module

Fixed: webrtc:11290
Change-Id: I471b409c27d6ee577a0ed84e3a09d31fbbc16fcd
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/222609
Reviewed-by: Per Kjellander <perkj@webrtc.org>
Commit-Queue: Johannes Kron <kron@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#34333}

modules/video_capture/linux/device_info_linux.cc

diff --git a/modules/video_capture/linux/device_info_linux.cc b/modules/video_capture/linux/device_info_linux.cc
index b3c9766..cde3b86 100644
--- a/modules/video_capture/linux/device_info_linux.cc
+++ b/modules/video_capture/linux/device_info_linux.cc
@@ -116,7 +116,7 @@
   memset(deviceNameUTF8, 0, deviceNameLength);
   memcpy(cameraName, cap.card, sizeof(cap.card));
 
-  if (deviceNameLength >= strlen(cameraName)) {
+  if (deviceNameLength > strlen(cameraName)) {
     memcpy(deviceNameUTF8, cameraName, strlen(cameraName));
   } else {
     RTC_LOG(LS_INFO) << "buffer passed is too small";
@@ -126,7 +126,7 @@
   if (cap.bus_info[0] != 0)  // may not available in all drivers
   {
     // copy device id
-    if (deviceUniqueIdUTF8Length >= strlen((const char*)cap.bus_info)) {
+    if (deviceUniqueIdUTF8Length > strlen((const char*)cap.bus_info)) {
       memset(deviceUniqueIdUTF8, 0, deviceUniqueIdUTF8Length);
       memcpy(deviceUniqueIdUTF8, cap.bus_info,
              strlen((const char*)cap.bus_info));
@@ -146,7 +146,7 @@
 
   const int32_t deviceUniqueIdUTF8Length =
       (int32_t)strlen((char*)deviceUniqueIdUTF8);
-  if (deviceUniqueIdUTF8Length > kVideoCaptureUniqueNameLength) {
+  if (deviceUniqueIdUTF8Length >= kVideoCaptureUniqueNameLength) {
     RTC_LOG(LS_INFO) << "Device name too long";
     return -1;
   }

modules/video_capture/windows/device_info_ds.cc

diff --git a/modules/video_capture/windows/device_info_ds.cc b/modules/video_capture/windows/device_info_ds.cc
index 97f61f7..e3833bc 100644
--- a/modules/video_capture/windows/device_info_ds.cc
+++ b/modules/video_capture/windows/device_info_ds.cc
@@ -213,7 +213,7 @@
                                            uint32_t productUniqueIdUTF8Length) {
   const int32_t deviceUniqueIdUTF8Length = (int32_t)strlen(
       (char*)deviceUniqueIdUTF8);  // UTF8 is also NULL terminated
-  if (deviceUniqueIdUTF8Length > kVideoCaptureUniqueNameLength) {
+  if (deviceUniqueIdUTF8Length >= kVideoCaptureUniqueNameLength) {
     RTC_LOG(LS_INFO) << "Device name too long";
     return NULL;
   }
@@ -306,7 +306,7 @@
 
   const int32_t deviceUniqueIdUTF8Length =
       (int32_t)strlen((char*)deviceUniqueIdUTF8);
-  if (deviceUniqueIdUTF8Length > kVideoCaptureUniqueNameLength) {
+  if (deviceUniqueIdUTF8Length >= kVideoCaptureUniqueNameLength) {
     RTC_LOG(LS_INFO) << "Device name too long";
     return -1;
   }
@@ -568,7 +568,7 @@
   // Find the second occurrence.
   pos = strchr(pos + 1, '&');
   uint32_t bytesToCopy = (uint32_t)(pos - startPos);
-  if (pos && (bytesToCopy <= productUniqueIdUTF8Length) &&
+  if (pos && (bytesToCopy < productUniqueIdUTF8Length) &&
       bytesToCopy <= kVideoCaptureProductIdLength) {
     strncpy_s((char*)productUniqueIdUTF8, productUniqueIdUTF8Length,
               (char*)startPos, bytesToCopy);

modules/video_capture/windows/video_capture_ds.cc

diff --git a/modules/video_capture/windows/video_capture_ds.cc b/modules/video_capture/windows/video_capture_ds.cc
index 6dca747..1a1e519 100644
--- a/modules/video_capture/windows/video_capture_ds.cc
+++ b/modules/video_capture/windows/video_capture_ds.cc
@@ -57,7 +57,7 @@
 
 int32_t VideoCaptureDS::Init(const char* deviceUniqueIdUTF8) {
   const int32_t nameLength = (int32_t)strlen((char*)deviceUniqueIdUTF8);
-  if (nameLength > kVideoCaptureUniqueNameLength)
+  if (nameLength >= kVideoCaptureUniqueNameLength)
     return -1;
 
   // Store the device name