From 37e8ba211c5772397645ab488584575ddc9d36c2 Mon Sep 17 00:00:00 2001 From: eadler Date: Wed, 23 May 2018 09:16:20 +0000 Subject: [PATCH] cut: Fix out of boundary write on illegal list argument It is possible to trigger an out of boundary write in cut if an invalid range with autostart has been supplied. PR: 227330 Submitted by: tobias@stoeckmann.org --- usr.bin/cut/cut.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/usr.bin/cut/cut.c b/usr.bin/cut/cut.c index a963b7a99dd7..f5847794f313 100644 --- a/usr.bin/cut/cut.c +++ b/usr.bin/cut/cut.c @@ -210,6 +210,12 @@ get_list(char *list) needpos(maxval + 1); } + /* reversed range with autostart */ + if (maxval < autostart) { + maxval = autostart; + needpos(maxval + 1); + } + /* set autostart */ if (autostart) memset(positions + 1, '1', autostart);