]> granicus.if.org Git - procps-ng/commitdiff
0026-skill: Fix double-increment of pid_count.
authorQualys Security Advisory <qsa@qualys.com>
Thu, 1 Jan 1970 00:00:00 +0000 (00:00 +0000)
committerCraig Small <csmall@enc.com.au>
Sat, 23 Jun 2018 11:59:14 +0000 (21:59 +1000)
No need to "pid_count++;" because "ENLIST(pid," does it already. Right
now this can trigger a heap-based buffer overflow.

Also, remove the unneeded "pid_count = 0;" (it is static, and
skillsnice_parse() is called only once; and the other *_count variables
are not initialized explicitly either).

skill.c

diff --git a/skill.c b/skill.c
index 16dc4e39994c6a43af38686fb3ec1c9016248187..0f421d3b48197388788a9f21c3fefa893efced3d 100644 (file)
--- a/skill.c
+++ b/skill.c
@@ -429,8 +429,6 @@ static void parse_options(int argc,
             sig_or_pri = signo;
     }
 
-    pid_count = 0;
-
     while ((ch =
         getopt_long(argc, argv, "c:dfilnp:Lt:u:vwhV", longopts,
                 NULL)) != -1)
@@ -457,7 +455,6 @@ static void parse_options(int argc,
             ENLIST(pid,
                    strtol_or_err(optarg,
                          _("failed to parse argument")));
-            pid_count++;
             break;
         case 'L':
             pretty_print_signals();
@@ -526,7 +523,6 @@ static void parse_options(int argc,
         num = strtol(argv[0], &end, 10);
         if (errno == 0 && argv[0] != end && end != NULL && *end == '\0') {
             ENLIST(pid, num);
-            pid_count++;
         } else {
             ENLIST(cmd, argv[0]);
         }