From 6872fd3c9470e867df5ff4cdcbcfe758248b6b48 Mon Sep 17 00:00:00 2001 From: Eitan Adler Date: Wed, 23 May 2018 09:16:20 +0000 Subject: [PATCH] cut: Fix out of boundary write on illegal list argument It is possible to trigger an out of boundary write in cut if an invalid range with autostart has been supplied. PR: 227330 Submitted by: tobias@stoeckmann.org --- usr.bin/cut/cut.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/usr.bin/cut/cut.c b/usr.bin/cut/cut.c index a963b7a99dd7..f5847794f313 100644 --- a/usr.bin/cut/cut.c +++ b/usr.bin/cut/cut.c @@ -210,6 +210,12 @@ get_list(char *list) needpos(maxval + 1); } + /* reversed range with autostart */ + if (maxval < autostart) { + maxval = autostart; + needpos(maxval + 1); + } + /* set autostart */ if (autostart) memset(positions + 1, '1', autostart);