diff options
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | Src/utils.c | 14 |
2 files changed, 14 insertions, 5 deletions
diff --git a/ChangeLog b/ChangeLog index e36a0d49f..d186d29a7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2018-03-28 Oliver Kiddle <okiddle@yahoo.co.uk> + + * 42539: Src/utils.c: prevent overflow of PATH_MAX-sized + buffer in spelling correction + 2018-03-27 Peter Stephenson <p.stephenson@samsung.com> * Martijn: 42538: Src/utils.c, Test/A04redirect.ztst: diff --git a/Src/utils.c b/Src/utils.c index 466014263..eab407eee 100644 --- a/Src/utils.c +++ b/Src/utils.c @@ -2287,7 +2287,8 @@ struncpy(char **s, char *t, int n) { char *u = *s; - while (n-- && (*u++ = *t++)); + while (n-- && (*u = *t++)) + u++; *s = u; if (n > 0) /* just one null-byte will do, unlike strncpy(3) */ *u = '\0'; @@ -4424,17 +4425,20 @@ spname(char *oldname) * odd to the human reader, and we may make use of the total * * distance for all corrections at some point in the future. */ if (bestdist < maxthresh) { - strcpy(new, spnameguess); - strcat(new, old); - return newname; + struncpy(&new, spnameguess, sizeof(newname) - (new - newname)); + struncpy(&new, old, sizeof(newname) - (new - newname)); + return (new - newname) >= (sizeof(newname)-1) ? NULL : newname; } else return NULL; } else { maxthresh = bestdist + thresh; bestdist += thisdist; } - for (p = spnamebest; (*new = *p++);) + for (p = spnamebest; (*new = *p++);) { + if ((new - newname) >= (sizeof(newname)-1)) + return NULL; new++; + } } } |