diff options
| -rw-r--r-- | source4/lib/replace/snprintf.c | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/source4/lib/replace/snprintf.c b/source4/lib/replace/snprintf.c index adfd3c4d78..67b00b3d84 100644 --- a/source4/lib/replace/snprintf.c +++ b/source4/lib/replace/snprintf.c @@ -53,6 +53,12 @@ * got rid of fcvt code (twas buggy and made testing harder) * added C99 semantics * + * Darren Tucker (dtucker@zip.com.au) + * Fix bug allowing read overruns of the source string with "%.*s" + * Usually harmless unless the read runs outside the process' allocation + * (eg if your malloc does guard pages) in which case it will segfault. + * From OpenSSH. Also added test for same. + * **************************************************************/ #ifndef NO_CONFIG_H /* for some tests */ @@ -436,7 +442,7 @@ static void fmtstr(char *buffer, size_t *currlen, size_t maxlen, value = "<NULL>"; } - for (strln = 0; value[strln]; ++strln); /* strlen */ + for (strln = 0; strln < max && value[strln]; ++strln); /* strlen */ padlen = min - strln; if (padlen < 0) padlen = 0; @@ -851,6 +857,7 @@ static void dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c) { char buf1[1024]; char buf2[1024]; + char *buf3; char *fp_fmt[] = { "%1.1f", "%-1.5f", @@ -959,6 +966,20 @@ static void dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c) } } +#define BUFSZ 2048 + + if ((buf3 = malloc(BUFSZ)) == NULL) { + fail++; + } else { + num++; + memset(buf3, 'a', BUFSZ); + snprintf(buf1, sizeof(buf1), "%.*s", 1, buf3); + if (strcmp(buf1, "a") != 0) { + printf("length limit buf1 '%s' expected 'a'\n", buf1); + fail++; + } + } + printf ("%d tests failed out of %d.\n", fail, num); printf("seeing how many digits we support\n"); |