d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sed: Bounds check the file path used in the 'w' command.

Browse Source 
Modified version of a diff from Sebastien Marie to prevent a crash found
with the afl fuzzer.

Obtained from:	OpenBSD (CVS Rev. 1.37)
MFC after:	1 week
This commit is contained in:
Pedro F. Giffuni 2014-12-16 20:26:11 +00:00
parent 2d45c2d52d
commit a34b42e43c
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=275838
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
usr.bin/sed/compile.c
View File

@ -558,7 +558,7 @@ compile_flags(char *p, struct s_subst *s)
{ {
int gn; /* True if we have seen g or n */ int gn; /* True if we have seen g or n */
unsigned long nval; unsigned long nval;
char wfile[_POSIX2_LINE_MAX + 1], *q; char wfile[_POSIX2_LINE_MAX + 1], *q, *eq;
s->n = 1; /* Default */ s->n = 1; /* Default */
s->p = 0; s->p = 0;
@ -611,9 +611,12 @@ compile_flags(char *p, struct s_subst *s)
#endif #endif
EATSPACE(); EATSPACE();
q = wfile; q = wfile;
eq = wfile + sizeof(wfile) - 1;
while (*p) { while (*p) {
if (*p == '\n') if (*p == '\n')
break; break;
if (q >= eq)
err(1, "wfile too long");
*q++ = *p++; *q++ = *p++;
} }
*q = '\0'; *q = '\0';