diff options
| author |   jsg <jsg@openbsd.org> | 2014-12-12 03:32:55 +0000 |
|---|---|---|
| committer | jsg <jsg@openbsd.org> | 2014-12-12 03:32:55 +0000 |
| commit | 53ac88bd3c3586aaf62b4619f5f9146df85bd373 (patch) | |
| tree | 3b056ad8bd088968cc872a1f4e607a73a5a489cb /usr.bin/sed/compile.c | |
| parent | Rework the pointer swap in the 'P' command to make the intent (diff) | |
| download | wireguard-openbsd-53ac88bd3c3586aaf62b4619f5f9146df85bd373.tar.xz wireguard-openbsd-53ac88bd3c3586aaf62b4619f5f9146df85bd373.zip | |
Bounds check the file path used in the 'w' command. Modified version
of a diff from Sebastien Marie to prevent a crash found by Sebastien
with the afl fuzzer.
Diffstat (limited to 'usr.bin/sed/compile.c')
| -rw-r--r-- | usr.bin/sed/compile.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/usr.bin/sed/compile.c b/usr.bin/sed/compile.c index 84dafe3d991..266da719772 100644 --- a/usr.bin/sed/compile.c +++ b/usr.bin/sed/compile.c @@ -1,4 +1,4 @@ -/* $OpenBSD: compile.c,v 1.36 2014/10/08 04:19:08 deraadt Exp $ */ +/* $OpenBSD: compile.c,v 1.37 2014/12/12 03:32:55 jsg Exp $ */ /*- * Copyright (c) 1992 Diomidis Spinellis. @@ -538,7 +538,7 @@ compile_flags(char *p, struct s_subst *s) { int gn; /* True if we have seen g or n */ long l; - char wfile[PATH_MAX], *q; + char wfile[PATH_MAX], *q, *eq; s->n = 1; /* Default */ s->p = 0; @@ -584,9 +584,12 @@ compile_flags(char *p, struct s_subst *s) #endif EATSPACE(); q = wfile; + eq = wfile + sizeof(wfile) - 1; while (*p) { if (*p == '\n') break; + if (q >= eq) + err(COMPILE, "wfile too long"); *q++ = *p++; } *q = '\0'; |