]> granicus.if.org Git - procps-ng/commitdiff
proc/devname.c: Never write more than "chop" characters.
authorQualys Security Advisory <qsa@qualys.com>
Thu, 1 Jan 1970 00:00:00 +0000 (00:00 +0000)
committerCraig Small <csmall@enc.com.au>
Fri, 18 May 2018 21:32:21 +0000 (07:32 +1000)
This should be guaranteed by "tmp[chop] = '\0';" and "if(!c) break;" but
this patch adds a very easy belt-and-suspenders check.

proc/devname.c

index f673a417d38ec2b9811b9d73c70103d559596d77..08ed131d88d960e3a923e2513589a7af72ebebfa 100644 (file)
@@ -351,7 +351,7 @@ abbrev:
   if(chop + (unsigned long)(tmp-buf) < sizeof buf)
     tmp[chop] = '\0';
   /* replace non-ASCII characters with '?' and return the number of chars */
-  for(;;){
+  while(i < chop){
     c = *tmp;
     tmp++;
     if(!c) break;