]> granicus.if.org Git - procps-ng/commitdiff
skill: Fix double-increment of pid_count.
authorQualys Security Advisory <qsa@qualys.com>
Thu, 1 Jan 1970 00:00:00 +0000 (00:00 +0000)
committerCraig Small <csmall@enc.com.au>
Fri, 18 May 2018 21:32:21 +0000 (07:32 +1000)
No need to "pid_count++;" because "ENLIST(pid," does it already. Right
now this can trigger a heap-based buffer overflow.

Also, remove the unneeded "pid_count = 0;" (it is static, and
skillsnice_parse() is called only once; and the other *_count variables
are not initialized explicitly either).

skill.c

diff --git a/skill.c b/skill.c
index 08043c1b0a6d84a78a070239168169885ae6c1ea..012f5a116f49d0e005ac5df0763422fce0ede0a8 100644 (file)
--- a/skill.c
+++ b/skill.c
@@ -595,8 +595,6 @@ static void skillsnice_parse(int argc,
                        sig_or_pri = signo;
        }
 
-       pid_count = 0;
-
        while ((ch =
                getopt_long(argc, argv, "c:dfilnp:Lt:u:vwhV", longopts,
                            NULL)) != -1)
@@ -623,7 +621,6 @@ static void skillsnice_parse(int argc,
                        ENLIST(pid,
                               strtol_or_err(optarg,
                                             _("failed to parse argument")));
-                       pid_count++;
                        break;
                case 'L':
                        pretty_print_signals();
@@ -692,7 +689,6 @@ static void skillsnice_parse(int argc,
                num = strtol(argv[0], &end, 10);
                if (errno == 0 && argv[0] != end && end != NULL && *end == '\0') {
                        ENLIST(pid, num);
-                       pid_count++;
                } else {
                        ENLIST(cmd, argv[0]);
                }