Date: Fri, 14 Aug 1998 02:51:57 +0900 (JST) From: shigio@wafu.netgate.net To: FreeBSD-gnats-submit@FreeBSD.ORG Cc: shigio@wafu.netgate.net Subject: bin/7607: GTAGS patch for nvi has posibility of buffer overflow. Message-ID: <199808131750.KAA07368@hub.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 7607
>Category: bin
>Synopsis: GTAGS patch for nvi has posibility of buffer overflow.
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Aug 13 11:00:00 PDT 1998
>Last-Modified:
>Originator: Shigio Yamaguchi
>Organization:
freelance programmer
>Release: FreeBSD 2.2.5-RELEASE i386
>Environment:
All environment.
>Description:
GTAGS patch for nvi has posibility of buffer overflow.
o gtag_slist() - sprintf() brings buffer overflow.
o getentry() - insufficient error check and buffer size.
>How-To-Repeat:
no
>Fix:
o gtags_slist() - use snprintf() instead of sprintf().
o getentry() - error check added and doesn't use small buffer.
Here is a patch for /usr/src/contrib/nvi/ex/ex_tag.c.
(FreeBSD-current, FreeBSD-stable)
*** ex_tag.c.org Fri Aug 14 02:30:36 1998
--- ex_tag.c Fri Aug 14 02:32:22 1998
***************
*** 47,53 ****
static void ctag_file __P((SCR *, TAGF *, char *, char **, size_t *));
static int ctag_search __P((SCR *, char *, size_t, char *));
#ifdef GTAGS
! static int getentry __P((char *, char *, char *, char *));
static TAGQ *gtag_slist __P((SCR *, char *, int));
#endif
static int ctag_sfile __P((SCR *, TAGF *, TAGQ *, char *));
--- 47,53 ----
static void ctag_file __P((SCR *, TAGF *, char *, char **, size_t *));
static int ctag_search __P((SCR *, char *, size_t, char *));
#ifdef GTAGS
! static int getentry __P((char *, char **, char **, char **));
static TAGQ *gtag_slist __P((SCR *, char *, int));
#endif
static int ctag_sfile __P((SCR *, TAGF *, TAGQ *, char *));
***************
*** 1013,1042 ****
*/
static int
getentry(buf, tag, file, line)
! char *buf, *tag, *file, *line;
{
! char *p;
! p = tag;
! while (*buf && !isspace(*buf)) /* tag name */
! *p++ = *buf++;
! *p = 0;
! while (*buf && isspace(*buf)) /* skip blanks */
! buf++;
! p = line;
! while (*buf && !isspace(*buf)) /* line no */
! *p++ = *buf++;
! *p = 0;
! while (*buf && isspace(*buf)) /* skip blanks */
! buf++;
! p = file;
! while (*buf && !isspace(*buf)) /* file name */
! *p++ = *buf++;
*p = 0;
/* value check */
! if (strlen(tag) && strlen(line) && strlen(file) && atoi(line) > 0)
return 1; /* OK */
return 0; /* ERROR */
}
--- 1013,1052 ----
*/
static int
getentry(buf, tag, file, line)
! char *buf, **tag, **file, **line;
{
! char *p = buf;
! for (*tag = p; *p && !isspace(*p); p++) /* tag name */
! ;
! if (*p == 0)
! goto err;
! *p++ = 0;
! for (; *p && isspace(*p); p++) /* (skip blanks) */
! ;
! if (*p == 0)
! goto err;
! *line = p; /* line no */
! for (*line = p; *p && !isspace(*p); p++)
! ;
! if (*p == 0)
! goto err;
! *p++ = 0;
! for (; *p && isspace(*p); p++) /* (skip blanks) */
! ;
! if (*p == 0)
! goto err;
! *file = p; /* file name */
! for (*file = p; *p && !isspace(*p); p++)
! ;
! if (*p == 0)
! goto err;
*p = 0;
/* value check */
! if (strlen(*tag) && strlen(*line) && strlen(*file) && atoi(*line) > 0)
return 1; /* OK */
+ err:
return 0; /* ERROR */
}
***************
*** 1056,1064 ****
size_t len;
int echk;
TAG *tp;
! static char name[80], file[200], line[10];
! char command[200];
! char buf[BUFSIZ+1];
FILE *fp;
/* Allocate and initialize the tag queue structure. */
--- 1066,1074 ----
size_t len;
int echk;
TAG *tp;
! char *name, *file, *line;
! char command[BUFSIZ];
! char buf[BUFSIZ];
FILE *fp;
/* Allocate and initialize the tag queue structure. */
***************
*** 1072,1078 ****
* Find the tag, only display missing file messages once, and
* then only if we didn't find the tag.
*/
! sprintf(command, "global -%s '%s'", ref ? "rx" : "x", tag);
if (fp = popen(command, "r")) {
while (fgets(buf, sizeof(buf), fp)) {
if (buf[strlen(buf)-1] == '\n') /* chop(buf) */
--- 1082,1088 ----
* Find the tag, only display missing file messages once, and
* then only if we didn't find the tag.
*/
! snprintf(command, sizeof(command), "global -%s '%s'", ref ? "rx" : "x", tag);
if (fp = popen(command, "r")) {
while (fgets(buf, sizeof(buf), fp)) {
if (buf[strlen(buf)-1] == '\n') /* chop(buf) */
***************
*** 1080,1086 ****
else
while (fgetc(fp) != '\n')
;
! if (getentry(buf, name, file, line) == 0) {
echk = 1;
F_SET(tfp, TAGF_ERR);
break;
--- 1090,1096 ----
else
while (fgetc(fp) != '\n')
;
! if (getentry(buf, &name, &file, &line) == 0) {
echk = 1;
F_SET(tfp, TAGF_ERR);
break;
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199808131750.KAA07368>