vde-2.2.2-slirpvde-buffer-overflow.patch 1.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950
  1. From d466d77be6ec40d8d7d96050fbee5e17e7c61af9 Mon Sep 17 00:00:00 2001
  2. From: Ludwig Nussel <ludwig.nussel@suse.de>
  3. Date: Tue, 30 Sep 2008 16:59:01 +0200
  4. Subject: [PATCH] fix static buffer overflows
  5. ---
  6. src/slirpvde/slirpvde.c | 12 +++++++-----
  7. 1 files changed, 7 insertions(+), 5 deletions(-)
  8. diff --git a/src/slirpvde/slirpvde.c b/src/slirpvde/slirpvde.c
  9. index 47512ca..016aa45 100644
  10. --- a/src/slirpvde/slirpvde.c
  11. +++ b/src/slirpvde/slirpvde.c
  12. @@ -53,7 +53,7 @@
  13. VDECONN *conn;
  14. int dhcpmgmt=0;
  15. static char *pidfile = NULL;
  16. -static char pidfile_path[_POSIX_PATH_MAX];
  17. +static char pidfile_path[PATH_MAX];
  18. int logok=0;
  19. char *prog;
  20. extern FILE *lfd;
  21. @@ -78,9 +78,11 @@ void printlog(int priority, const char *format, ...)
  22. static void save_pidfile()
  23. {
  24. if(pidfile[0] != '/')
  25. - strncat(pidfile_path, pidfile, PATH_MAX - strlen(pidfile_path));
  26. - else
  27. - strcpy(pidfile_path, pidfile);
  28. + strncat(pidfile_path, pidfile, sizeof(pidfile_path) - strlen(pidfile_path) -1);
  29. + else {
  30. + pidfile_path[0] = 0;
  31. + strncat(pidfile_path, pidfile, sizeof(pidfile_path)-1);
  32. + }
  33. int fd = open(pidfile_path,
  34. O_WRONLY | O_CREAT | O_EXCL,
  35. @@ -433,7 +435,7 @@ int main(int argc, char **argv)
  36. exit(1);
  37. }
  38. - strcat(pidfile_path, "/");
  39. + strncat(pidfile_path, "/", sizeof(pidfile_path) - strlen(pidfile_path) -1);
  40. if (daemonize && daemon(0, 0)) {
  41. printlog(LOG_ERR,"daemon: %s",strerror(errno));
  42. exit(1);
  43. --
  44. 1.5.6