From 66aec526fcdb91bfabca7be638eff13d53b51a8a Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 23 Dec 2025 12:03:10 +0100 Subject: [PATCH] lib547, 555: fix off-by-one null-terminator in read callback `strcpy()` wrote an unnecessary null-terminator past the available read buffer. test551 was also affected because it reuses lib547. Cherry-picked from #20076 Closes #20082 --- tests/libtest/lib547.c | 2 +- tests/libtest/lib555.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/libtest/lib547.c b/tests/libtest/lib547.c index cafb845f70..6611bdeaec 100644 --- a/tests/libtest/lib547.c +++ b/tests/libtest/lib547.c @@ -44,7 +44,7 @@ static size_t t547_read_cb(char *ptr, size_t size, size_t nmemb, void *clientp) if(size * nmemb >= T547_DATALEN) { curl_mfprintf(stderr, "READ!\n"); - strcpy(ptr, t547_uploadthis); + memcpy(ptr, t547_uploadthis, T547_DATALEN); return T547_DATALEN; } curl_mfprintf(stderr, "READ NOT FINE!\n"); diff --git a/tests/libtest/lib555.c b/tests/libtest/lib555.c index b0573b7f1a..883b73b5bb 100644 --- a/tests/libtest/lib555.c +++ b/tests/libtest/lib555.c @@ -48,7 +48,7 @@ static size_t t555_read_cb(char *ptr, size_t size, size_t nmemb, void *clientp) if(size * nmemb >= T555_DATALEN) { curl_mfprintf(stderr, "READ!\n"); - strcpy(ptr, t555_uploadthis); + memcpy(ptr, t555_uploadthis, T555_DATALEN); return T555_DATALEN; } curl_mfprintf(stderr, "READ NOT FINE!\n");