|
 |
304803 |
autofs-5.1.0 - fix buffer size checks in get_network_proximity()
|
|
|
304803 |
|
|
|
304803 |
From: Ian Kent <raven@themaw.net>
|
|
|
304803 |
|
|
|
304803 |
Add several buffer size checks in get_network_proximity().
|
|
|
304803 |
---
|
|
|
304803 |
CHANGELOG | 1 +
|
|
|
304803 |
lib/parse_subs.c | 8 +++++---
|
|
|
304803 |
2 files changed, 6 insertions(+), 3 deletions(-)
|
|
|
304803 |
|
|
|
304803 |
--- autofs-5.0.7.orig/CHANGELOG
|
|
|
304803 |
+++ autofs-5.0.7/CHANGELOG
|
|
|
304803 |
@@ -135,6 +135,7 @@
|
|
|
304803 |
- fix FILE pointer check in defaults_read_config().
|
|
|
304803 |
- fix memory leak in conf_amd_get_log_options().
|
|
|
304803 |
- fix signed comparison in inet_fill_net().
|
|
|
304803 |
+- fix buffer size checks in get_network_proximity().
|
|
|
304803 |
|
|
|
304803 |
25/07/2012 autofs-5.0.7
|
|
|
304803 |
=======================
|
|
|
304803 |
--- autofs-5.0.7.orig/lib/parse_subs.c
|
|
|
304803 |
+++ autofs-5.0.7/lib/parse_subs.c
|
|
|
304803 |
@@ -437,7 +437,7 @@ unsigned int get_network_proximity(const
|
|
|
304803 |
{
|
|
|
304803 |
struct addrinfo hints;
|
|
|
304803 |
struct addrinfo *ni, *this;
|
|
|
304803 |
- char name_or_num[NI_MAXHOST];
|
|
|
304803 |
+ char name_or_num[NI_MAXHOST + 1];
|
|
|
304803 |
unsigned int proximity;
|
|
|
304803 |
char *net;
|
|
|
304803 |
int ret;
|
|
|
304803 |
@@ -449,16 +449,18 @@ unsigned int get_network_proximity(const
|
|
|
304803 |
if (net)
|
|
|
304803 |
strcpy(name_or_num, net);
|
|
|
304803 |
else {
|
|
|
304803 |
- char this[NI_MAXHOST];
|
|
|
304803 |
+ char this[NI_MAXHOST + 1];
|
|
|
304803 |
char *mask;
|
|
|
304803 |
|
|
|
304803 |
+ if (strlen(name) > NI_MAXHOST)
|
|
|
304803 |
+ return PROXIMITY_ERROR;
|
|
|
304803 |
strcpy(this, name);
|
|
|
304803 |
if ((mask = strchr(this, '/')))
|
|
|
304803 |
*mask++ = '\0';
|
|
|
304803 |
if (!strchr(this, '.'))
|
|
|
304803 |
strcpy(name_or_num, this);
|
|
|
304803 |
else {
|
|
|
304803 |
- char buf[NI_MAXHOST], *new;
|
|
|
304803 |
+ char buf[NI_MAXHOST + 1], *new;
|
|
|
304803 |
new = inet_fill_net(this, buf);
|
|
|
304803 |
if (!new)
|
|
|
304803 |
return PROXIMITY_ERROR;
|