From efa38539495d4c97cbbab553df97583beeaeb2a2 Mon Sep 17 00:00:00 2001 From: Peter Wemm Date: Sun, 28 Jul 1996 20:29:10 +0000 Subject: [PATCH] Limit the risk of `buf' overrun in ping.c when printing hostnames. Note, this is not really a security risk, because the buffer in question is a static variable in the data segment and not on the stack, and hence cannot subert the flow of execution in any way. About the worst case was that if you pinged a long hostname, ping could coredump. Pointed out on: bugtraq (listserv@netspace.org) --- sbin/ping/ping.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sbin/ping/ping.c b/sbin/ping/ping.c index 3545c319ec20..de19a4575d02 100644 --- a/sbin/ping/ping.c +++ b/sbin/ping/ping.c @@ -959,9 +959,10 @@ pr_addr(l) if ((options & F_NUMERIC) || !(hp = gethostbyaddr((char *)&l, 4, AF_INET))) - (void)sprintf(buf, "%s", inet_ntoa(*(struct in_addr *)&l)); + (void)snprintf(buf, sizeof(buf), "%s", + inet_ntoa(*(struct in_addr *)&l)); else - (void)sprintf(buf, "%s (%s)", hp->h_name, + (void)snprintf(buf, sizeof(buf), "%s (%s)", hp->h_name, inet_ntoa(*(struct in_addr *)&l)); return(buf); }