d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Buffer overflow fix - closes PR bin/2983 for -current. Should really

Browse Source 
go into 2.2.0 Release, even at the present time.  Problem spotted by
Tero Kivinen <kivinen@ssh.fi> - was in BugTraq today :-(
This commit is contained in:
Eivind Eklund 1997-03-17 09:30:19 +00:00
parent f721b0c392
commit 92d1e8a27b
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=23961
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
lib/libtermcap/tgoto.c
View File

@ -90,6 +90,8 @@ tgoto(const char *CM, int destcol, int destline)
added[0] = 0;
while ( (c = *cp++) ) {
if (c != '%') {
if (dp >= &result[MAXRETURNSIZE])
return ("OVERFLOW");
*dp++ = c;
continue;
}
@ -110,14 +112,20 @@ tgoto(const char *CM, int destcol, int destline)
/* fall into... */
case '3':
if (dp >= &result[MAXRETURNSIZE])
return ("OVERFLOW");
*dp++ = (which / 100) | '0';
which %= 100;
/* fall into... */
case '2':
two:
if (dp >= &result[MAXRETURNSIZE])
return ("OVERFLOW");
*dp++ = which / 10 | '0';
one:
if (dp >= &result[MAXRETURNSIZE])
return ("OVERFLOW");
*dp++ = which % 10 | '0';
swap:
oncol = 1 - oncol;
@ -170,6 +178,8 @@ tgoto(const char *CM, int destcol, int destline)
which++;
} while (which == '\n');
}
if (dp >= &result[MAXRETURNSIZE])
return ("OVERFLOW");
*dp++ = which;
goto swap;
@ -184,6 +194,8 @@ tgoto(const char *CM, int destcol, int destline)
continue;
case '%':
if (dp >= &result[MAXRETURNSIZE])
return ("OVERFLOW");
*dp++ = c;
continue;
@ -203,6 +215,8 @@ tgoto(const char *CM, int destcol, int destline)
goto toohard;
}
}
if (dp+strlen(added)+1 > &result[MAXRETURNSIZE])
return ("OVERFLOW");
strcpy(dp, added);
return (result);
}