diff options
| author | pfg <pfg@FreeBSD.org> | 2014-12-23 02:46:00 +0000 |
|---|---|---|
| committer | pfg <pfg@FreeBSD.org> | 2014-12-23 02:46:00 +0000 |
| commit | 7b207849cbad77ed6a3972f8b30f8efb007f8d17 (patch) | |
| tree | 9e3e66c1c299a7a6a2b5745f3acf36d977f6e5dd /usr.bin/sed | |
| parent | 347db77978dc57dabd83c2629afb6099718a2cff (diff) | |
| download | FreeBSD-src-7b207849cbad77ed6a3972f8b30f8efb007f8d17.zip FreeBSD-src-7b207849cbad77ed6a3972f8b30f8efb007f8d17.tar.gz | |
MFC r275838;
sed: Bounds check the file path used in the 'w' command.
Modified version of a diff from Sebastien Marie to prevent a crash found
with the afl fuzzer.
Obtained from: OpenBSD (CVS Rev. 1.37)
Diffstat (limited to 'usr.bin/sed')
| -rw-r--r-- | usr.bin/sed/compile.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/usr.bin/sed/compile.c b/usr.bin/sed/compile.c index e146668..c7fbe21 100644 --- a/usr.bin/sed/compile.c +++ b/usr.bin/sed/compile.c @@ -558,7 +558,7 @@ compile_flags(char *p, struct s_subst *s) { int gn; /* True if we have seen g or n */ unsigned long nval; - char wfile[_POSIX2_LINE_MAX + 1], *q; + char wfile[_POSIX2_LINE_MAX + 1], *q, *eq; s->n = 1; /* Default */ s->p = 0; @@ -611,9 +611,12 @@ compile_flags(char *p, struct s_subst *s) #endif EATSPACE(); q = wfile; + eq = wfile + sizeof(wfile) - 1; while (*p) { if (*p == '\n') break; + if (q >= eq) + err(1, "wfile too long"); *q++ = *p++; } *q = '\0'; |
