diff options
| author | pfg <pfg@FreeBSD.org> | 2014-12-16 20:26:11 +0000 |
|---|---|---|
| committer | pfg <pfg@FreeBSD.org> | 2014-12-16 20:26:11 +0000 |
| commit | 5daaead4310d660291f22352cb5d220c6d9ccb5e (patch) | |
| tree | 1a4d245b62b8ccee11698888d9831ae4890cbe78 /usr.bin/sed | |
| parent | 42d5fa98d30175edd5c387fa437ec4d956cb2300 (diff) | |
| download | FreeBSD-src-5daaead4310d660291f22352cb5d220c6d9ccb5e.zip FreeBSD-src-5daaead4310d660291f22352cb5d220c6d9ccb5e.tar.gz | |
sed: Bounds check the file path used in the 'w' command.
Modified version of a diff from Sebastien Marie to prevent a crash found
with the afl fuzzer.
Obtained from: OpenBSD (CVS Rev. 1.37)
MFC after: 1 week
Diffstat (limited to 'usr.bin/sed')
| -rw-r--r-- | usr.bin/sed/compile.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/usr.bin/sed/compile.c b/usr.bin/sed/compile.c index e146668..c7fbe21 100644 --- a/usr.bin/sed/compile.c +++ b/usr.bin/sed/compile.c @@ -558,7 +558,7 @@ compile_flags(char *p, struct s_subst *s) { int gn; /* True if we have seen g or n */ unsigned long nval; - char wfile[_POSIX2_LINE_MAX + 1], *q; + char wfile[_POSIX2_LINE_MAX + 1], *q, *eq; s->n = 1; /* Default */ s->p = 0; @@ -611,9 +611,12 @@ compile_flags(char *p, struct s_subst *s) #endif EATSPACE(); q = wfile; + eq = wfile + sizeof(wfile) - 1; while (*p) { if (*p == '\n') break; + if (q >= eq) + err(1, "wfile too long"); *q++ = *p++; } *q = '\0'; |
