Author: pfg
Date: Tue Dec 23 02:46:00 2014
New Revision: 276099
URL: https://svnweb.freebsd.org/changeset/base/276099
Log:
MFC r275838;
sed: Bounds check the file path used in the 'w' command.
Modified version of a diff from Sebastien Marie to prevent a crash found
with the afl fuzzer.
Obtained from: OpenBSD (CVS Rev. 1.37)
Modified:
stable/10/usr.bin/sed/compile.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/usr.bin/sed/compile.c
==============================================================================
--- stable/10/usr.bin/sed/compile.c Tue Dec 23 02:14:49 2014
(r276098)
+++ stable/10/usr.bin/sed/compile.c Tue Dec 23 02:46:00 2014
(r276099)
@@ -558,7 +558,7 @@ compile_flags(char *p, struct s_subst *s
{
int gn; /* True if we have seen g or n */
unsigned long nval;
- char wfile[_POSIX2_LINE_MAX + 1], *q;
+ char wfile[_POSIX2_LINE_MAX + 1], *q, *eq;
s->n = 1; /* Default */
s->p = 0;
@@ -611,9 +611,12 @@ compile_flags(char *p, struct s_subst *s
#endif
EATSPACE();
q = wfile;
+ eq = wfile + sizeof(wfile) - 1;
while (*p) {
if (*p == '\n')
break;
+ if (q >= eq)
+ err(1, "wfile too long");
*q++ = *p++;
}
*q = '\0';
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
