XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-03-24 08:04:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

xfree86: fix potential buffer overflow

Browse Source 
The patch below fixes a potential buffer overflow in xf86addComment().
This occurs if  curlen > 0 && eol_seen == 0 && iscomment == 0 , as
follows from the code:

char *xf86addComment(char *cur, char *add)

<...>

        len = strlen(add);
        endnewline = add[len - 1] == '\n';
        len +=  1 + iscomment + (!hasnewline) + (!endnewline) + eol_seen;

        if ((str = realloc(cur, len + curlen)) == NULL)
                return cur;

        cur = str;

        if (eol_seen || (curlen && !hasnewline))
                cur[curlen++] = '\n';
        if (!iscomment)
                cur[curlen++] = '#';
        strcpy(cur + curlen, add);
        if (!endnewline)
                strcat(cur, "\n");

Signed-off-by: Servaas Vandenberghe <vdb@picaros.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>

[whot: added buffer overflow test case]

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
Servaas Vandenberghe
2011-08-31 07:06:49 +02:00
committed by Peter Hutterer
parent 63e87b8639
commit 820d9040f5
2 changed files with 39 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
test/xfree86.c
View File

@@ -29,6 +29,7 @@
#include "xf86.h"
#include "xf86Parser.h"
static void
xfree86_option_list_duplicate(void)
@@ -73,9 +74,34 @@ xfree86_option_list_duplicate(void)
assert(a && b);
}
static void
xfree86_add_comment(void)
{
char *current = NULL, *comment;
char compare[1024] = {0};
comment = "# foo";
current = xf86addComment(current, comment);
strcpy(compare, comment);
strcat(compare, "\n");
assert(!strcmp(current, compare));
/* this used to overflow */
strcpy(current, "\n");
comment = "foobar\n";
current = xf86addComment(current, comment);
strcpy(compare, "\n#");
strcat(compare, comment);
assert(!strcmp(current, compare));
free(current);
}
int main(int argc, char** argv)
{
xfree86_option_list_duplicate();
xfree86_add_comment();
return 0;
}