mir/isc-dhcp
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/dhcp synced 2025-08-30 13:57:50 +00:00
Code Issues Releases Wiki Activity

Bounds check the output buffer in do_percentm.

Browse Source
This commit is contained in:
Ted Lemon
2000-09-29 20:01:49 +00:00
parent 723deaee8f
commit 0a10a8df1d
1 changed files with 19 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
omapip/errwarn.c
View File

@@ -42,7 +42,7 @@
#ifndef lint #ifndef lint
static char copyright[] = static char copyright[] =
"$Id: errwarn.c,v 1.8 2000/09/04 22:28:10 mellon Exp $ Copyright (c) 1996 The Internet Software Consortium. All rights reserved.\n"; "$Id: errwarn.c,v 1.9 2000/09/29 20:01:49 mellon Exp $ Copyright (c) 1996 The Internet Software Consortium. All rights reserved.\n";
#endif /* not lint */ #endif /* not lint */
#include <omapip/omapip_p.h> #include <omapip/omapip_p.h>
@@ -56,8 +56,9 @@ int log_perror = 1;
int log_priority; int log_priority;
void (*log_cleanup) (void); void (*log_cleanup) (void);
static char mbuf [1024]; #define CVT_BUF_MAX 1023
static char fbuf [1024]; static char mbuf [CVT_BUF_MAX + 1];
static char fbuf [CVT_BUF_MAX + 1];
/* Log an error message, then exit... */ /* Log an error message, then exit... */
@@ -187,13 +188,11 @@ void do_percentm (obuf, ibuf)
char *p = obuf; char *p = obuf;
int infmt = 0; int infmt = 0;
const char *m; const char *m;
int len = 0;
while (*s) while (*s) {
{ if (infmt) {
if (infmt) if (*s == 'm') {
{
if (*s == 'm')
{
#ifndef __CYGWIN32__ #ifndef __CYGWIN32__
m = strerror (errno); m = strerror (errno);
#else #else
@@ -201,21 +200,27 @@ void do_percentm (obuf, ibuf)
#endif #endif
if (!m) if (!m)
m = "<unknown error>"; m = "<unknown error>";
len += strlen (m);
if (len > CVT_BUF_MAX)
goto out;
strcpy (p - 1, m); strcpy (p - 1, m);
p += strlen (p); p += strlen (p);
++s; ++s;
} } else {
else if (++len > CVT_BUF_MAX)
goto out;
*p++ = *s++; *p++ = *s++;
infmt = 0;
} }
else infmt = 0;
{ } else {
if (*s == '%') if (*s == '%')
infmt = 1; infmt = 1;
if (++len > CVT_BUF_MAX)
goto out;
*p++ = *s++; *p++ = *s++;
} }
} }
out:
*p = 0; *p = 0;
} }