diff options
| author | amdmi3 <amdmi3@FreeBSD.org> | 2015-09-22 16:59:41 +0000 |
|---|---|---|
| committer | amdmi3 <amdmi3@FreeBSD.org> | 2015-09-22 16:59:41 +0000 |
| commit | e84416dd44028a21c126ff713eb7f2f5ba8c1fab (patch) | |
| tree | 33ef991a063dba65a1da1735fafb78fcb5dd2ecf /usr.sbin/ndiscvt | |
| parent | 10b8b85018a68155b9aab67a85779ba4d1cfcdd8 (diff) | |
| download | FreeBSD-src-e84416dd44028a21c126ff713eb7f2f5ba8c1fab.zip FreeBSD-src-e84416dd44028a21c126ff713eb7f2f5ba8c1fab.tar.gz | |
Fix crash on parsing some inf files
ndiscvt uses 16 entry array for words into which it parses
comma-separated lists of strings, like AddReg line in
[somesection]
AddReg = foo.reg, bar.reg, baz.reg, quiz.reg
Overflows were not checked so it crashed on a line with 17 words
encountered in some Broadcom/Dell Wireless 1704 802.11b-g-n driver
So extend the array up to 32 entries and add an overflow check.
Reviewed by: bapt
Approved by: bapt
MFC after: 2 weeks
Differential Revision: D3713
Diffstat (limited to 'usr.sbin/ndiscvt')
| -rw-r--r-- | usr.sbin/ndiscvt/inf.c | 6 | ||||
| -rw-r--r-- | usr.sbin/ndiscvt/inf.h | 2 |
2 files changed, 7 insertions, 1 deletions
diff --git a/usr.sbin/ndiscvt/inf.c b/usr.sbin/ndiscvt/inf.c index fe4db6a..4b30da0 100644 --- a/usr.sbin/ndiscvt/inf.c +++ b/usr.sbin/ndiscvt/inf.c @@ -887,6 +887,12 @@ regkey_add (const char *r) void push_word (const char *w) { + + if (idx == W_MAX) { + fprintf(stderr, "too many words; try bumping W_MAX in inf.h\n"); + exit(1); + } + if (w && strlen(w)) words[idx++] = w; else diff --git a/usr.sbin/ndiscvt/inf.h b/usr.sbin/ndiscvt/inf.h index 8d0b0c1..ba08d67 100644 --- a/usr.sbin/ndiscvt/inf.h +++ b/usr.sbin/ndiscvt/inf.h @@ -4,7 +4,7 @@ * $FreeBSD$ */ -#define W_MAX 16 +#define W_MAX 32 struct section { const char * name; |
