diff options
| author | ache <ache@FreeBSD.org> | 2000-09-08 11:42:37 +0000 |
|---|---|---|
| committer | ache <ache@FreeBSD.org> | 2000-09-08 11:42:37 +0000 |
| commit | ddefbaa46bf87777a261883dd5243cef0a6225c7 (patch) | |
| tree | ed6a964423ced5af502030e5930b93631123aee8 /lib | |
| parent | 41776e16ebb8a286443869729742582c91b2da09 (diff) | |
| download | FreeBSD-src-ddefbaa46bf87777a261883dd5243cef0a6225c7.zip FreeBSD-src-ddefbaa46bf87777a261883dd5243cef0a6225c7.tar.gz | |
Prevent buffer overflow if NLSPATH is too long
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libc/nls/msgcat.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/lib/libc/nls/msgcat.c b/lib/libc/nls/msgcat.c index 1dbdf4f..5a0f9a9 100644 --- a/lib/libc/nls/msgcat.c +++ b/lib/libc/nls/msgcat.c @@ -144,6 +144,8 @@ catopen( name, type) ++nlspath; /* fallthrough */ default: + if (pathP - path >= sizeof(path) - 1) + goto too_long; *(pathP++) = *nlspath; continue; } @@ -151,13 +153,17 @@ catopen( name, type) put_tmpptr: spcleft = sizeof(path) - (pathP - path) - 1; if (strlcpy(pathP, tmpptr, spcleft) >= spcleft) { + too_long: free(plang); free(base); NLRETERR(ENAMETOOLONG); } pathP += strlen(tmpptr); - } else + } else { + if (pathP - path >= sizeof(path) - 1) + goto too_long; *(pathP++) = *nlspath; + } } *pathP = '\0'; if (stat(path, &sbuf) == 0) { |
