|
 |
306fa1 |
autofs-5.1.0 - fix buffer size checks in merge_options()
|
|
|
306fa1 |
|
|
|
306fa1 |
From: Ian Kent <raven@themaw.net>
|
|
|
306fa1 |
|
|
|
306fa1 |
Fix some buffer size overflow checks in merge_options().
|
|
|
306fa1 |
---
|
|
|
306fa1 |
CHANGELOG | 1 +
|
|
|
306fa1 |
lib/parse_subs.c | 25 +++++++++++++++++++++----
|
|
|
306fa1 |
2 files changed, 22 insertions(+), 4 deletions(-)
|
|
|
306fa1 |
|
|
|
306fa1 |
--- autofs-5.0.7.orig/CHANGELOG
|
|
|
306fa1 |
+++ autofs-5.0.7/CHANGELOG
|
|
|
306fa1 |
@@ -137,6 +137,7 @@
|
|
|
306fa1 |
- fix signed comparison in inet_fill_net().
|
|
|
306fa1 |
- fix buffer size checks in get_network_proximity().
|
|
|
306fa1 |
- fix leak in get_network_proximity().
|
|
|
306fa1 |
+- fix buffer size checks in merge_options().
|
|
|
306fa1 |
|
|
|
306fa1 |
25/07/2012 autofs-5.0.7
|
|
|
306fa1 |
=======================
|
|
|
306fa1 |
--- autofs-5.0.7.orig/lib/parse_subs.c
|
|
|
306fa1 |
+++ autofs-5.0.7/lib/parse_subs.c
|
|
|
306fa1 |
@@ -886,11 +886,11 @@ static char *hasopt(const char *str, con
|
|
|
306fa1 |
|
|
|
306fa1 |
char *merge_options(const char *opt1, const char *opt2)
|
|
|
306fa1 |
{
|
|
|
306fa1 |
- char str[MAX_OPTIONS_LEN];
|
|
|
306fa1 |
- char result[MAX_OPTIONS_LEN];
|
|
|
306fa1 |
- char neg[MAX_OPTION_LEN];
|
|
|
306fa1 |
+ char str[MAX_OPTIONS_LEN + 1];
|
|
|
306fa1 |
+ char result[MAX_OPTIONS_LEN + 1];
|
|
|
306fa1 |
+ char neg[MAX_OPTION_LEN + 1];
|
|
|
306fa1 |
char *tok, *ptr = NULL;
|
|
|
306fa1 |
- size_t len;
|
|
|
306fa1 |
+ size_t resultlen, len;
|
|
|
306fa1 |
|
|
|
306fa1 |
if ((!opt1 || !*opt1) && (!opt2 || !*opt2))
|
|
|
306fa1 |
return NULL;
|
|
|
306fa1 |
@@ -910,9 +910,12 @@ char *merge_options(const char *opt1, co
|
|
|
306fa1 |
if (!strcmp(opt1, opt2))
|
|
|
306fa1 |
return strdup(opt1);
|
|
|
306fa1 |
|
|
|
306fa1 |
+ if (strlen(str) > MAX_OPTIONS_LEN)
|
|
|
306fa1 |
+ return NULL;
|
|
|
306fa1 |
memset(result, 0, sizeof(result));
|
|
|
306fa1 |
strcpy(str, opt1);
|
|
|
306fa1 |
|
|
|
306fa1 |
+ resultlen = 0;
|
|
|
306fa1 |
tok = strtok_r(str, ",", &ptr);
|
|
|
306fa1 |
while (tok) {
|
|
|
306fa1 |
const char *this = (const char *) tok;
|
|
|
306fa1 |
@@ -920,12 +923,15 @@ char *merge_options(const char *opt1, co
|
|
|
306fa1 |
if (eq) {
|
|
|
306fa1 |
*eq = '\0';
|
|
|
306fa1 |
if (!hasopt(opt2, this)) {
|
|
|
306fa1 |
+ if (resultlen + strlen(this) > MAX_OPTIONS_LEN)
|
|
|
306fa1 |
+ return NULL;
|
|
|
306fa1 |
*eq = '=';
|
|
|
306fa1 |
if (!*result)
|
|
|
306fa1 |
strcpy(result, this);
|
|
|
306fa1 |
else
|
|
|
306fa1 |
strcat(result, this);
|
|
|
306fa1 |
strcat(result, ",");
|
|
|
306fa1 |
+ resultlen += strlen(this) + 1;
|
|
|
306fa1 |
goto next;
|
|
|
306fa1 |
}
|
|
|
306fa1 |
}
|
|
|
306fa1 |
@@ -946,10 +952,14 @@ char *merge_options(const char *opt1, co
|
|
|
306fa1 |
goto next;
|
|
|
306fa1 |
|
|
|
306fa1 |
if (!strncmp(this, "no", 2)) {
|
|
|
306fa1 |
+ if (strlen(this + 2) > MAX_OPTION_LEN)
|
|
|
306fa1 |
+ return NULL;
|
|
|
306fa1 |
strcpy(neg, this + 2);
|
|
|
306fa1 |
if (hasopt(opt2, neg))
|
|
|
306fa1 |
goto next;
|
|
|
306fa1 |
} else {
|
|
|
306fa1 |
+ if ((strlen(this) + 2) > MAX_OPTION_LEN)
|
|
|
306fa1 |
+ return NULL;
|
|
|
306fa1 |
strcpy(neg, "no");
|
|
|
306fa1 |
strcat(neg, this);
|
|
|
306fa1 |
if (hasopt(opt2, neg))
|
|
|
306fa1 |
@@ -959,15 +969,22 @@ char *merge_options(const char *opt1, co
|
|
|
306fa1 |
if (hasopt(opt2, tok))
|
|
|
306fa1 |
goto next;
|
|
|
306fa1 |
|
|
|
306fa1 |
+ if (resultlen + strlen(this) + 1 > MAX_OPTIONS_LEN)
|
|
|
306fa1 |
+ return NULL;
|
|
|
306fa1 |
+
|
|
|
306fa1 |
if (!*result)
|
|
|
306fa1 |
strcpy(result, this);
|
|
|
306fa1 |
else
|
|
|
306fa1 |
strcat(result, this);
|
|
|
306fa1 |
strcat(result, ",");
|
|
|
306fa1 |
+ resultlen =+ strlen(this) + 1;
|
|
|
306fa1 |
next:
|
|
|
306fa1 |
tok = strtok_r(NULL, ",", &ptr);
|
|
|
306fa1 |
}
|
|
|
306fa1 |
|
|
|
306fa1 |
+ if (resultlen + strlen(opt2) > MAX_OPTIONS_LEN)
|
|
|
306fa1 |
+ return NULL;
|
|
|
306fa1 |
+
|
|
|
306fa1 |
if (!*result)
|
|
|
306fa1 |
strcpy(result, opt2);
|
|
|
306fa1 |
else
|