Buffer overflow fix - closes PR bin/2983 for -current. Should really

go into 2.2.0 Release, even at the present time.  Problem spotted by
Tero Kivinen <kivinen@ssh.fi> - was in BugTraq today :-(

1 files changed, 14 insertions, 0 deletions

diff --git a/lib/libtermcap/tgoto.c b/lib/libtermcap/tgoto.c
index 85b8d57..ca49302 100644
--- a/lib/libtermcap/tgoto.c
+++ b/lib/libtermcap/tgoto.c
@@ -90,6 +90,8 @@ toohard:
 	added[0] = 0;
 	while ( (c = *cp++) ) {
 		if (c != '%') {
+			if (dp >= &result[MAXRETURNSIZE])
+				return ("OVERFLOW");
 			*dp++ = c;
 			continue;
 		}
@@ -110,14 +112,20 @@ toohard:
 			/* fall into... */
 
 		case '3':
+			if (dp >= &result[MAXRETURNSIZE])
+				return ("OVERFLOW");
 			*dp++ = (which / 100) | '0';
 			which %= 100;
 			/* fall into... */
 
 		case '2':
 two:
+			if (dp >= &result[MAXRETURNSIZE])
+				return ("OVERFLOW");
 			*dp++ = which / 10 | '0';
 one:
+			if (dp >= &result[MAXRETURNSIZE])
+				return ("OVERFLOW");
 			*dp++ = which % 10 | '0';
 swap:
 			oncol = 1 - oncol;
@@ -170,6 +178,8 @@ casedot:
 						which++;
 					} while (which == '\n');
 			}
+			if (dp >= &result[MAXRETURNSIZE])
+				return ("OVERFLOW");
 			*dp++ = which;
 			goto swap;
 
@@ -184,6 +194,8 @@ casedot:
 			continue;
 
 		case '%':
+			if (dp >= &result[MAXRETURNSIZE])
+				return ("OVERFLOW");
 			*dp++ = c;
 			continue;
 
@@ -203,6 +215,8 @@ casedot:
 			goto toohard;
 		}
 	}
+	if (dp+strlen(added)+1 > &result[MAXRETURNSIZE])
+		return ("OVERFLOW");
 	strcpy(dp, added);
 	return (result);
 }