BUG/MINOR: tools: support the documented NULL in cbor_encode_bytes_prefix_bin()

Both cbor_encode_bytes_prefix_bin() and cbor_encode_text_bin() document
that "if <bytes> is NULL, then only the <prefix> (with length) will be
emitted", and the hex variants do implement it, their copy loop being
guarded with "while (bytes && it < len)". The bin one does not: it calls
memcpy() unconditionally, so passing NULL dereferences it and crashes,
and it advances <start> by <len> for bytes it never wrote.

No caller passed NULL so far, which is why this remained unnoticed, but
better fix it before it gets used, as it's trivial.

No backport needed.

diff --git a/src/tools.c b/src/tools.c
index 24a40a4b13ee4fcbdb9d25f6f2861c48c113d3b9..186e3a1449894f2927f886fb569436df9ab521fe 100644 (file)
--- a/src/tools.c
+++ b/src/tools.c
@@ -2408,10 +2408,12 @@ static inline char *_cbor_encode_bytes_prefix_bin(char *start, char *stop,
                return NULL;
 
        /* write actual bytes if provided */
-       if (start + len >= stop)
-               return NULL;
-       memcpy(start, bytes, len);
-       start += len;
+       if (bytes) {
+               if (start + len >= stop)
+                       return NULL;
+               memcpy(start, bytes, len);
+               start += len;
+       }
 
        return start;
 }