d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a buffer overflow due to sending strings >1k in length. This is unlikely

Browse Source 
to be a security problem, but it's not totally impossible. OpenBSD take note

Reviewed by:	imp
This commit is contained in:
kris 1999-11-25 07:28:54 +00:00
parent bc55786850
commit 9aee982353
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
usr.bin/chat/chat.c
View File

@ -655,7 +655,8 @@ int sending; /* set to 1 when sending (putting) this string. */
#define isoctal(chr) (((chr) >= '0') && ((chr) <= '7'))
s1 = temp;
while (*s) {
/* Don't overflow buffer, leave room for chars we append later */
while (*s && s1 - temp < sizeof(temp) - 2 - add_return) {
cur_chr = *s++;
if (cur_chr == '^') {
cur_chr = *s++;
@ -1275,6 +1276,13 @@ register char *string;
char *logged = temp;
fail_reason = (char *)0;
if (strlen(string) > STR_LEN) {
logf("expect string is too long");
exit_code = 1;
return 0;
}
string = clean(string, 0);
len = strlen(string);
minlen = (len > sizeof(fail_buffer)? len: sizeof(fail_buffer)) - 1;
@ -1282,12 +1290,6 @@ register char *string;
if (verbose)
logf("expect (%v)", string);
if (len > STR_LEN) {
logf("expect string is too long");
exit_code = 1;
return 0;
}
if (len == 0) {
if (verbose)
logf("got it");