d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix buffer overflow copying the ``kernel'' command-line argument into

Browse Source 
buffers.  The buffers have been resized from the irrelevant BUFSIZ
to the more relevant MAXPATHLEN + 1.

Reported by:	Mike Heffner <spock@techfour.net>
This commit is contained in:
Sheldon Hearn 2000-03-29 17:22:10 +00:00
parent bf7c9470c1
commit 9b75e14d30
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
usr.bin/kzip/kzip.c
View File

@ -51,8 +51,8 @@ main(int argc, char **argv)
struct stat st;
u_long forceaddr = 0, entry;
char *kernname;
char obj[BUFSIZ];
char out[BUFSIZ];
char obj[MAXPATHLEN + 1];
char out[MAXPATHLEN + 1];
char base[32];
while ((c = getopt(argc, argv, "l:v")) != -1) {
@ -78,6 +78,8 @@ main(int argc, char **argv)
kernname = argv[0];
if (strlen(kernname) > MAXPATHLEN - 3)
errx(1, "%s: File name too long", kernname);
strcpy(obj, kernname); strcat(obj,".o");
strcpy(out, kernname); strcat(out,".kz");