[PATCH 1/5] setterm: segfault with long dump file name

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The patch will make too long path to be truncated to MAX_PATH
lenght. If user supplies too long file name that is caught at
fopen. Some users might find this unintuitive, so the altered
behavior will be mantioned in manual page.

Bug in earlier version was visible with a command bellow.

setterm -dump -file $(for i in $(seq 254); do printf x ; done)

Signed-off-by: Sami Kerola <kerolasa@xxxxxx>
---
 term-utils/setterm.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/term-utils/setterm.c b/term-utils/setterm.c
index 14b2c3d..1ced695 100644
--- a/term-utils/setterm.c
+++ b/term-utils/setterm.c
@@ -202,7 +202,7 @@ int opt_tb_array[161];		/* Array for tab list */
 int opt_msglevel_num;
 int opt_ps_mode, opt_pd_min;	/* powersave mode/powerdown time */
 
-char opt_sn_name[200] = "screen.dump";
+char opt_sn_name[PATH_MAX + 1] = "screen.dump";
 
 static void screendump(int vcnum, FILE *F);
 
@@ -525,8 +525,9 @@ parse_snapfile(int argc, char **argv, int *option, int *opt_all, int *bad_arg) {
 	if (argc != 1 || *option)
 		*bad_arg = TRUE;
 	*option = TRUE;
+	memset(opt_all, 0, PATH_MAX + 1);
 	if (argc == 1)
-		strcpy((char *)opt_all, argv[0]);
+		strncpy((char *)opt_all, argv[0], PATH_MAX);
 }
 
 static void
-- 
1.7.4.2

--
To unsubscribe from this list: send the line "unsubscribe util-linux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Netdev]     [Ethernet Bridging]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]

  Powered by Linux