svn commit: samba r11799 - in branches/SAMBA_3_0/source/lib: .

jra at samba.org jra at samba.org
Sat Nov 19 01:14:06 GMT 2005


Author: jra
Date: 2005-11-19 01:14:05 +0000 (Sat, 19 Nov 2005)
New Revision: 11799

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=11799

Log:
Added OpenSSH fix for "%.*s" format crash. From Darren Tucker
<dtucker at zip.com.au>
Jeremy.

Modified:
   branches/SAMBA_3_0/source/lib/snprintf.c


Changeset:
Modified: branches/SAMBA_3_0/source/lib/snprintf.c
===================================================================
--- branches/SAMBA_3_0/source/lib/snprintf.c	2005-11-19 01:13:56 UTC (rev 11798)
+++ branches/SAMBA_3_0/source/lib/snprintf.c	2005-11-19 01:14:05 UTC (rev 11799)
@@ -89,6 +89,12 @@
  *
  *    Move #endif to make sure VA_COPY, LDOUBLE, etc are defined even
  *    if the C library has some snprintf functions already.
+ *
+ * Darren Tucker (dtucker at zip.com.au)
+ *    Fix bug allowing read overruns of the source string with "%.*s"
+ *    Usually harmless unless the read runs outside the process' allocation
+ *    (eg if your malloc does guard pages) in which case it will segfault.
+ *    From OpenSSH.  Also added test for same.
  **************************************************************/
 
 #ifndef NO_CONFIG_H
@@ -479,7 +485,7 @@
 		value = "<NULL>";
 	}
 
-	for (strln = 0; value[strln]; ++strln); /* strlen */
+	for (strln = 0; strln < max && value[strln]; ++strln); /* strlen */
 	padlen = min - strln;
 	if (padlen < 0) 
 		padlen = 0;
@@ -892,6 +898,7 @@
 {
 	char buf1[1024];
 	char buf2[1024];
+	char *buf3;
 	char *fp_fmt[] = {
 		"%1.1f",
 		"%-1.5f",
@@ -1001,6 +1008,20 @@
 		}
 	}
 
+#define BUFSZ 2048
+
+	if ((buf3 = malloc(BUFSZ)) == NULL) {
+		fail++;
+	} else {
+		num++;
+		memset(buf3, 'a', BUFSZ);
+		snprintf(buf1, sizeof(buf1), "%.*s", 1, buf3);
+		if (strcmp(buf1, "a") != 0) {
+			printf("length limit buf1 '%s' expected 'a'\n", buf1);
+			fail++;
+		}
+        }
+
 	printf ("%d tests failed out of %d.\n", fail, num);
 
 	printf("seeing how many digits we support\n");



More information about the samba-cvs mailing list