Author: amdmi3 (ports committer)
Date: Tue Sep 22 16:59:41 2015
New Revision: 288120
URL: https://svnweb.freebsd.org/changeset/base/288120
Log:
Fix crash on parsing some inf files
ndiscvt uses 16 entry array for words into which it parses
comma-separated lists of strings, like AddReg line in
[somesection]
AddReg = foo.reg, bar.reg, baz.reg, quiz.reg
Overflows were not checked so it crashed on a line with 17 words
encountered in some Broadcom/Dell Wireless 1704 802.11b-g-n driver
So extend the array up to 32 entries and add an overflow check.
Reviewed by: bapt
Approved by: bapt
MFC after: 2 weeks
Differential Revision: D3713
Modified:
head/usr.sbin/ndiscvt/inf.c
head/usr.sbin/ndiscvt/inf.h
Modified: head/usr.sbin/ndiscvt/inf.c
==============================================================================
--- head/usr.sbin/ndiscvt/inf.c Tue Sep 22 16:51:40 2015 (r288119)
+++ head/usr.sbin/ndiscvt/inf.c Tue Sep 22 16:59:41 2015 (r288120)
@@ -887,6 +887,12 @@ regkey_add (const char *r)
void
push_word (const char *w)
{
+
+ if (idx == W_MAX) {
+ fprintf(stderr, "too many words; try bumping W_MAX in inf.h\n");
+ exit(1);
+ }
+
if (w && strlen(w))
words[idx++] = w;
else
Modified: head/usr.sbin/ndiscvt/inf.h
==============================================================================
--- head/usr.sbin/ndiscvt/inf.h Tue Sep 22 16:51:40 2015 (r288119)
+++ head/usr.sbin/ndiscvt/inf.h Tue Sep 22 16:59:41 2015 (r288120)
@@ -4,7 +4,7 @@
* $FreeBSD$
*/
-#define W_MAX 16
+#define W_MAX 32
struct section {
const char * name;
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
