New submission from Venkatesh Srinivas <[email protected]>:
FreeBSD commit notes:
"fix a buffer overflow with large (100k+) number of input lines."
--- /usr/src/sbin/ipfw/ipfw2.c 2010-02-23 09:32:26 -0800
+++ ipfw2.c 2010-04-29 23:36:44 -0700
@@ -3494,7 +3494,7 @@
#define WHITESP " \t\f\v\n\r"
char buf[BUFSIZ];
char *a, *p, *args[MAX_ARGS], *cmd = NULL;
- char linename[10];
+ char linename[20];
int i=0, lineno=0, qflag=0, pflag=0, status;
FILE *f = NULL;
pid_t preproc = 0;
@@ -3586,7 +3586,7 @@
while (fgets(buf, BUFSIZ, f)) {
lineno++;
- sprintf(linename, "Line %d", lineno);
+ snprintf(linename, sizeof(linename), "Line %d", lineno);
args[0] = linename;
if (*buf == '#')
----------
messages: 8540
nosy: vsrinivas
status: unread
title: ipfw buffer overflow with lots of input lines (via FreeBSD commit 206494)
_____________________________________________________
DragonFly issue tracker <[email protected]>
<http://bugs.dragonflybsd.org/issue1753>
_____________________________________________________
