d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix crash on parsing some inf files

Browse Source 
ndiscvt uses 16 entry array for words into which it parses
comma-separated lists of strings, like AddReg line in

    [somesection]
        AddReg = foo.reg, bar.reg, baz.reg, quiz.reg

Overflows were not checked so it crashed on a line with 17 words
encountered in some Broadcom/Dell Wireless 1704 802.11b-g-n driver

So extend the array up to 32 entries and add an overflow check.

Reviewed by:	bapt
Approved by:	bapt
MFC after:	2 weeks
Differential Revision:	D3713
This commit is contained in:
Dmitry Marakasov 2015-09-22 16:59:41 +00:00
parent c9dbb1cc52
commit a40531fcf8
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
usr.sbin/ndiscvt/inf.c
View File

@ -887,6 +887,12 @@ regkey_add (const char *r)
void void
push_word (const char *w) push_word (const char *w)
{ {
if (idx == W_MAX) {
fprintf(stderr, "too many words; try bumping W_MAX in inf.h\n");
exit(1);
}
if (w && strlen(w)) if (w && strlen(w))
words[idx++] = w; words[idx++] = w;
else else

2
usr.sbin/ndiscvt/inf.h
View File

@ -4,7 +4,7 @@
* $FreeBSD$ * $FreeBSD$
*/ */
#define W_MAX 16 #define W_MAX 32
struct section { struct section {
const char * name; const char * name;