sed: Bounds check the file path used in the 'w' command.
Modified version of a diff from Sebastien Marie to prevent a crash found with the afl fuzzer. Obtained from: OpenBSD (CVS Rev. 1.37) MFC after: 1 week
This commit is contained in:
parent
2d45c2d52d
commit
a34b42e43c
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=275838
@ -558,7 +558,7 @@ compile_flags(char *p, struct s_subst *s)
|
|||||||
{
|
{
|
||||||
int gn; /* True if we have seen g or n */
|
int gn; /* True if we have seen g or n */
|
||||||
unsigned long nval;
|
unsigned long nval;
|
||||||
char wfile[_POSIX2_LINE_MAX + 1], *q;
|
char wfile[_POSIX2_LINE_MAX + 1], *q, *eq;
|
||||||
|
|
||||||
s->n = 1; /* Default */
|
s->n = 1; /* Default */
|
||||||
s->p = 0;
|
s->p = 0;
|
||||||
@ -611,9 +611,12 @@ compile_flags(char *p, struct s_subst *s)
|
|||||||
#endif
|
#endif
|
||||||
EATSPACE();
|
EATSPACE();
|
||||||
q = wfile;
|
q = wfile;
|
||||||
|
eq = wfile + sizeof(wfile) - 1;
|
||||||
while (*p) {
|
while (*p) {
|
||||||
if (*p == '\n')
|
if (*p == '\n')
|
||||||
break;
|
break;
|
||||||
|
if (q >= eq)
|
||||||
|
err(1, "wfile too long");
|
||||||
*q++ = *p++;
|
*q++ = *p++;
|
||||||
}
|
}
|
||||||
*q = '\0';
|
*q = '\0';
|
||||||
|
Loading…
Reference in New Issue
Block a user