Bug #1753

ipfw buffer overflow with lots of input lines (via FreeBSD commit 206494)

Added by vsrinivas almost 4 years ago.

Status:NewStart date:
Priority:NormalDue date:
Assignee:-% Done:

0%

Category:-
Target version:-

Description

FreeBSD commit notes:

"fix a buffer overflow with large (100k+) number of input lines."

--- /usr/src/sbin/ipfw/ipfw2.c 2010-02-23 09:32:26 -0800
+++ ipfw2.c 2010-04-29 23:36:44 -0700
@@ -3494,7 +3494,7 @@
#define WHITESP " \t\f\v\n\r"
char buf[BUFSIZ];
char *a, *p, *args[MAX_ARGS], *cmd = NULL;
- char linename[10];
+ char linename[20];
int i=0, lineno=0, qflag=0, pflag=0, status;
FILE *f = NULL;
pid_t preproc = 0;
@@ -3586,7 +3586,7 @@

while (fgets(buf, BUFSIZ, f)) {
lineno++;
- sprintf(linename, "Line %d", lineno);
+ snprintf(linename, sizeof(linename), "Line %d", lineno);
args[0] = linename;

if (*buf == '#')

Also available in: Atom PDF