Submit #1753: ipfw buffer overflow with lots of input lines (via FreeBSD commit 206494) - DragonFlyBSD - DragonFlyBSD bugtracker

Actions

Copy link

Submit #1753

closed

ipfw buffer overflow with lots of input lines (via FreeBSD commit 206494)

Added by vsrinivas almost 14 years ago. Updated over 9 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Category:

Userland

Target version:

4.2

Start date:

Due date:

% Done:

Estimated time:

Description

FreeBSD commit notes:

"fix a buffer overflow with large (100k+) number of input lines."

--- /usr/src/sbin/ipfw/ipfw2.c 2010-02-23 09:32:26 0800
++ ipfw2.c 2010-04-29 23:36:44 -0700
@ -3494,7 +3494,7 @
#define WHITESP " \t\f\v\n\r"
char buf[BUFSIZ];
char *a, *p, *args[MAX_ARGS], *cmd = NULL;
char linename¹⁰;
char linename²⁰;
int i=0, lineno=0, qflag=0, pflag=0, status;
FILE *f = NULL;
pid_t preproc = 0;
@ -3586,7 +3586,7 @

while (fgets(buf, BUFSIZ, f)) {
         lineno++;
-        sprintf(linename, "Line %d", lineno);
+        snprintf(linename, sizeof(linename), "Line %d", lineno);
         args[0] = linename;