Prevent internal buffer overflow due to expansion of $LANG and/or name
argument in catopen(). Reviewed by: chris, -audit
This commit is contained in:
parent
ab9e9f9d2d
commit
84b578d562
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=64274
@ -91,8 +91,9 @@ int type;
|
||||
__const char *catpath = NULL;
|
||||
char *nlspath;
|
||||
char *lang;
|
||||
long len;
|
||||
char *base, *cptr, *pathP;
|
||||
int spcleft;
|
||||
long len;
|
||||
struct stat sbuf;
|
||||
|
||||
if (!name || !*name) {
|
||||
@ -129,13 +130,20 @@ int type;
|
||||
*cptr = '\0';
|
||||
for (pathP = path; *nlspath; ++nlspath) {
|
||||
if (*nlspath == '%') {
|
||||
spcleft = sizeof(path) - (pathP - path);
|
||||
if (*(nlspath + 1) == 'L') {
|
||||
++nlspath;
|
||||
strcpy(pathP, lang);
|
||||
if (strlcpy(pathP, lang, spcleft) >= spcleft) {
|
||||
errno = ENAMETOOLONG;
|
||||
return(NLERR);
|
||||
}
|
||||
pathP += strlen(lang);
|
||||
} else if (*(nlspath + 1) == 'N') {
|
||||
++nlspath;
|
||||
strcpy(pathP, name);
|
||||
if (strlcpy(pathP, name, spcleft) >= spcleft) {
|
||||
errno = ENAMETOOLONG;
|
||||
return(NLERR);
|
||||
}
|
||||
pathP += strlen(name);
|
||||
} else *(pathP++) = *nlspath;
|
||||
} else *(pathP++) = *nlspath;
|
||||
|
Loading…
Reference in New Issue
Block a user