[PATCH 05/25] [libx11] Possible overrun of 8192 byte fixed size buffer "buffer" by copying "ext->name" without length checking

[Erkki Seppälä]

Fixed by using strncpy and explicitly terminating the buffer

Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-olive...@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.sepp...@vincit.fi>
---
 src/XlibInt.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/XlibInt.c b/src/XlibInt.c
index d55c26a..52ccff1 100644
--- a/src/XlibInt.c
+++ b/src/XlibInt.c
@@ -1438,9 +1438,10 @@ static int _XPrintDefaultError(
             ext && (ext->codes.major_opcode != event->request_code);
             ext = ext->next)
          ;
-       if (ext)
-           strcpy(buffer, ext->name);
-       else
+       if (ext) {
+           strncpy(buffer, ext->name, BUFSIZ);
+           buffer[BUFSIZ - 1] = '\0';
+        } else
            buffer[0] = '\0';
     }
     (void) fprintf(fp, " (%s)\n", buffer);
-- 
1.7.0.4

_______________________________________________
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel