Blame SOURCES/autofs-5.1.0-fix-buffer-size-checks-in-merge_options.patch

304803
autofs-5.1.0 - fix buffer size checks in merge_options()
304803
304803
From: Ian Kent <raven@themaw.net>
304803
304803
Fix some buffer size overflow checks in merge_options().
304803
---
304803
 CHANGELOG        |    1 +
304803
 lib/parse_subs.c |   25 +++++++++++++++++++++----
304803
 2 files changed, 22 insertions(+), 4 deletions(-)
304803
304803
--- autofs-5.0.7.orig/CHANGELOG
304803
+++ autofs-5.0.7/CHANGELOG
304803
@@ -137,6 +137,7 @@
304803
 - fix signed comparison in inet_fill_net().
304803
 - fix buffer size checks in get_network_proximity().
304803
 - fix leak in get_network_proximity().
304803
+- fix buffer size checks in merge_options().
304803
 
304803
 25/07/2012 autofs-5.0.7
304803
 =======================
304803
--- autofs-5.0.7.orig/lib/parse_subs.c
304803
+++ autofs-5.0.7/lib/parse_subs.c
304803
@@ -886,11 +886,11 @@ static char *hasopt(const char *str, con
304803
 
304803
 char *merge_options(const char *opt1, const char *opt2)
304803
 {
304803
-	char str[MAX_OPTIONS_LEN];
304803
-	char result[MAX_OPTIONS_LEN];
304803
-	char neg[MAX_OPTION_LEN];
304803
+	char str[MAX_OPTIONS_LEN + 1];
304803
+	char result[MAX_OPTIONS_LEN + 1];
304803
+	char neg[MAX_OPTION_LEN + 1];
304803
 	char *tok, *ptr = NULL;
304803
-	size_t len;
304803
+	size_t resultlen, len;
304803
 
304803
 	if ((!opt1 || !*opt1) && (!opt2 || !*opt2))
304803
 		return NULL;
304803
@@ -910,9 +910,12 @@ char *merge_options(const char *opt1, co
304803
 	if (!strcmp(opt1, opt2))
304803
 		return strdup(opt1);
304803
 
304803
+	if (strlen(str) > MAX_OPTIONS_LEN)
304803
+		return NULL;
304803
 	memset(result, 0, sizeof(result));
304803
 	strcpy(str, opt1);
304803
 
304803
+	resultlen = 0;
304803
 	tok = strtok_r(str, ",", &ptr);
304803
 	while (tok) {
304803
 		const char *this = (const char *) tok;
304803
@@ -920,12 +923,15 @@ char *merge_options(const char *opt1, co
304803
 		if (eq) {
304803
 			*eq = '\0';
304803
 			if (!hasopt(opt2, this)) {
304803
+				if (resultlen + strlen(this) > MAX_OPTIONS_LEN)
304803
+					return NULL;
304803
 				*eq = '=';
304803
 				if (!*result)
304803
 					strcpy(result, this);
304803
 				else
304803
 					strcat(result, this);
304803
 				strcat(result, ",");
304803
+				resultlen += strlen(this) + 1;
304803
 				goto next;
304803
 			}
304803
 		}
304803
@@ -946,10 +952,14 @@ char *merge_options(const char *opt1, co
304803
 			goto next;
304803
 
304803
 		if (!strncmp(this, "no", 2)) {
304803
+			if (strlen(this + 2) > MAX_OPTION_LEN)
304803
+				return NULL;
304803
 			strcpy(neg, this + 2);
304803
 			if (hasopt(opt2, neg))
304803
 				goto next;
304803
 		} else {
304803
+			if ((strlen(this) + 2) > MAX_OPTION_LEN)
304803
+				return NULL;
304803
 			strcpy(neg, "no");
304803
 			strcat(neg, this);
304803
 			if (hasopt(opt2, neg))
304803
@@ -959,15 +969,22 @@ char *merge_options(const char *opt1, co
304803
 		if (hasopt(opt2, tok))
304803
 			goto next;
304803
 
304803
+		if (resultlen + strlen(this) + 1 > MAX_OPTIONS_LEN)
304803
+			return NULL;
304803
+
304803
 		if (!*result)
304803
 			strcpy(result, this);
304803
 		else
304803
 			strcat(result, this);
304803
 		strcat(result, ",");
304803
+		resultlen =+ strlen(this) + 1;
304803
 next:
304803
 		tok = strtok_r(NULL, ",", &ptr);
304803
 	}
304803
 
304803
+	if (resultlen + strlen(opt2) > MAX_OPTIONS_LEN)
304803
+		return NULL;
304803
+
304803
 	if (!*result)
304803
 		strcpy(result, opt2);
304803
 	else