Project

General

Profile

Actions
Copy link

Submit #1753

closed

ipfw buffer overflow with lots of input lines (via FreeBSD commit 206494)

Added by vsrinivas over 14 years ago. Updated almost 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Userland
Target version:
4.2
Start date:
Due date:
% Done:

0%

Estimated time:

Description

FreeBSD commit notes:

"fix a buffer overflow with large (100k+) number of input lines."

--- /usr/src/sbin/ipfw/ipfw2.c 2010-02-23 09:32:26 0800
++ ipfw2.c 2010-04-29 23:36:44 -0700
@ -3494,7 +3494,7 @
#define WHITESP " \t\f\v\n\r"
char buf[BUFSIZ];
char *a, *p, *args[MAX_ARGS], *cmd = NULL;
 char linename10;
char linename20;
int i=0, lineno=0, qflag=0, pflag=0, status;
FILE *f = NULL;
pid_t preproc = 0;
@ -3586,7 +3586,7 @

while (fgets(buf, BUFSIZ, f)) {
         lineno++;
-        sprintf(linename, "Line %d", lineno);
+        snprintf(linename, sizeof(linename), "Line %d", lineno);
         args[0] = linename;
if (*buf == '#')
Actions
Copy link

Also available in: Atom PDF