Another buffer overflow similar to the recent one in mkstr(1).

2002-11-01 12:48:28 +00:00 · 2002-11-01 12:48:28 +00:00 · 5e6cfbf3a7
commit 5e6cfbf3a7
parent ff3a30e723
1 changed files with 2 additions and 0 deletions
--- a/usr.bin/xstr/xstr.c
+++ b/usr.bin/xstr/xstr.c
@ -231,6 +231,8 @@ yankstr(char **cpp)
 	static char tmp[] = "b\bt\tr\rn\nf\f\\\\\"\"";

 	while ((c = *cp++)) {
+		if (dp == dbuf + sizeof(dbuf) - 3)
+			errx(1, "message too long");
 		switch (c) {

 		case '"':