Limit the risk of `buf' overrun in ping.c when printing hostnames.
Note, this is not really a security risk, because the buffer in question is a static variable in the data segment and not on the stack, and hence cannot subert the flow of execution in any way. About the worst case was that if you pinged a long hostname, ping could coredump. Pointed out on: bugtraq (listserv@netspace.org)
This commit is contained in:
parent
ef1c2ba16f
commit
efa3853949
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=17320
@ -959,9 +959,10 @@ pr_addr(l)
|
|||||||
|
|
||||||
if ((options & F_NUMERIC) ||
|
if ((options & F_NUMERIC) ||
|
||||||
!(hp = gethostbyaddr((char *)&l, 4, AF_INET)))
|
!(hp = gethostbyaddr((char *)&l, 4, AF_INET)))
|
||||||
(void)sprintf(buf, "%s", inet_ntoa(*(struct in_addr *)&l));
|
(void)snprintf(buf, sizeof(buf), "%s",
|
||||||
|
inet_ntoa(*(struct in_addr *)&l));
|
||||||
else
|
else
|
||||||
(void)sprintf(buf, "%s (%s)", hp->h_name,
|
(void)snprintf(buf, sizeof(buf), "%s (%s)", hp->h_name,
|
||||||
inet_ntoa(*(struct in_addr *)&l));
|
inet_ntoa(*(struct in_addr *)&l));
|
||||||
return(buf);
|
return(buf);
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user