From 5cfa736ad08cb37cd60a09752cd7df997f2370f8 Mon Sep 17 00:00:00 2001
From: Klaus Schmidinger <vdr@tvdr.de>
Date: Wed, 10 Jun 2020 20:52:10 +0200
Subject: Fixed memory handling in cString::Append()

---
 CONTRIBUTORS |  1 +
 HISTORY      |  1 +
 tools.c      | 18 +++++++++++-------
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 36ce8bd1..ae420977 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -3510,6 +3510,7 @@ Stefan Herdler <herdler@gmx.de>
  too early
  for reporting a bug in using the default sort mode in a video directory without a
  ".sort" file
+ for reporting faulty memory handling in cString::Append()
 
 Tobias Faust <tobias.faust@gmx.de>
  for the original "jumpingseconds" patch
diff --git a/HISTORY b/HISTORY
index a2f49745..58816ebe 100644
--- a/HISTORY
+++ b/HISTORY
@@ -9462,3 +9462,4 @@ Video Disk Recorder Revision History
   indicate this change.
 - Added a device hook for detecting whether a device provides EIT data (thanks to
   Winfried Köhler).
+- Fixed memory handling in cString::Append() (reported by Stefan Herdler).
diff --git a/tools.c b/tools.c
index 7330fce1..67136221 100644
--- a/tools.c
+++ b/tools.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: tools.c 4.11 2018/03/04 10:28:04 kls Exp $
+ * $Id: tools.c 4.12 2020/06/10 20:52:10 kls Exp $
  */
 
 #include "tools.h"
@@ -1099,12 +1099,16 @@ cString &cString::operator=(const char *String)
 
 cString &cString::Append(const char *String)
 {
-  int l1 = strlen(s);
-  int l2 = strlen(String);
-  char *p = (char *)realloc(s, l1 + l2 + 1);
-  if (p != s)
-     strcpy(p, s);
-  strcpy(p + l1, String);
+  if (String) {
+     int l1 = s ? strlen(s) : 0;
+     int l2 = strlen(String);
+     if (char *p = (char *)realloc(s, l1 + l2 + 1)) {
+        s = p;
+        strcpy(s + l1, String);
+        }
+     else
+        esyslog("ERROR: out of memory");
+     }
   return *this;
 }
 
-- 
cgit v1.2.3