From: msv <msv@opencascade.com>
Date: Mon, 2 Mar 2015 13:06:30 +0000 (+0300)
Subject: 0025860: Buffer overrun in TopTools_ShapeSet::Read
X-Git-Tag: V6_9_0_beta~67
X-Git-Url: http://git.dev.opencascade.org/gitweb/?a=commitdiff_plain;h=5149c3f34bc78740ad716686e90ca5d81b1480dc;p=occt-copy.git

0025860: Buffer overrun in TopTools_ShapeSet::Read

Avoid out of array bounds read/write.
---

diff --git a/src/TopTools/TopTools_ShapeSet.cxx b/src/TopTools/TopTools_ShapeSet.cxx
index 5c7484820b..5a81fc791f 100644
--- a/src/TopTools/TopTools_ShapeSet.cxx
+++ b/src/TopTools/TopTools_ShapeSet.cxx
@@ -612,8 +612,11 @@ void  TopTools_ShapeSet::Read(Standard_IStream& IS)
     //if(pm = strchr(vers,'\r'))
     //  *pm ='\0';
     
-    for (Standard_Size lv = (strlen(vers)- 1); lv > 1 && (vers[lv] == '\r' || vers[lv] == '\n') ;lv--) 
-      vers[lv] = '\0';
+    Standard_Size lv = strlen(vers);
+    if (lv > 0) {
+      for (lv--; lv > 0 && (vers[lv] == '\r' || vers[lv] == '\n') ;lv--) 
+        vers[lv] = '\0';
+    }
     
   } while ( ! IS.fail() && strcmp(vers,Version) && strcmp(vers,Version2) );
   if (IS.fail()) {