autofs-5.1.0 - fix buffer size checks in get_network_proximity() From: Ian Kent Add several buffer size checks in get_network_proximity(). --- CHANGELOG | 1 + lib/parse_subs.c | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) --- autofs-5.0.7.orig/CHANGELOG +++ autofs-5.0.7/CHANGELOG @@ -135,6 +135,7 @@ - fix FILE pointer check in defaults_read_config(). - fix memory leak in conf_amd_get_log_options(). - fix signed comparison in inet_fill_net(). +- fix buffer size checks in get_network_proximity(). 25/07/2012 autofs-5.0.7 ======================= --- autofs-5.0.7.orig/lib/parse_subs.c +++ autofs-5.0.7/lib/parse_subs.c @@ -437,7 +437,7 @@ unsigned int get_network_proximity(const { struct addrinfo hints; struct addrinfo *ni, *this; - char name_or_num[NI_MAXHOST]; + char name_or_num[NI_MAXHOST + 1]; unsigned int proximity; char *net; int ret; @@ -449,16 +449,18 @@ unsigned int get_network_proximity(const if (net) strcpy(name_or_num, net); else { - char this[NI_MAXHOST]; + char this[NI_MAXHOST + 1]; char *mask; + if (strlen(name) > NI_MAXHOST) + return PROXIMITY_ERROR; strcpy(this, name); if ((mask = strchr(this, '/'))) *mask++ = '\0'; if (!strchr(this, '.')) strcpy(name_or_num, this); else { - char buf[NI_MAXHOST], *new; + char buf[NI_MAXHOST + 1], *new; new = inet_fill_net(this, buf); if (!new) return PROXIMITY_ERROR;