From c053c6a0799397632df9ba88f8812a1da49c67f1 Mon Sep 17 00:00:00 2001 From: Oliver Kiddle Date: Wed, 28 Mar 2018 09:00:58 +0200 Subject: 42539: prevent overflow of PATH_MAX-sized buffer in spelling correction --- ChangeLog | 5 +++++ Src/utils.c | 14 +++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index e36a0d49f..d186d29a7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2018-03-28 Oliver Kiddle + + * 42539: Src/utils.c: prevent overflow of PATH_MAX-sized + buffer in spelling correction + 2018-03-27 Peter Stephenson * Martijn: 42538: Src/utils.c, Test/A04redirect.ztst: diff --git a/Src/utils.c b/Src/utils.c index 466014263..eab407eee 100644 --- a/Src/utils.c +++ b/Src/utils.c @@ -2287,7 +2287,8 @@ struncpy(char **s, char *t, int n) { char *u = *s; - while (n-- && (*u++ = *t++)); + while (n-- && (*u = *t++)) + u++; *s = u; if (n > 0) /* just one null-byte will do, unlike strncpy(3) */ *u = '\0'; @@ -4424,17 +4425,20 @@ spname(char *oldname) * odd to the human reader, and we may make use of the total * * distance for all corrections at some point in the future. */ if (bestdist < maxthresh) { - strcpy(new, spnameguess); - strcat(new, old); - return newname; + struncpy(&new, spnameguess, sizeof(newname) - (new - newname)); + struncpy(&new, old, sizeof(newname) - (new - newname)); + return (new - newname) >= (sizeof(newname)-1) ? NULL : newname; } else return NULL; } else { maxthresh = bestdist + thresh; bestdist += thisdist; } - for (p = spnamebest; (*new = *p++);) + for (p = spnamebest; (*new = *p++);) { + if ((new - newname) >= (sizeof(newname)-1)) + return NULL; new++; + } } } -- cgit 1.4.1