Skip to content

N
nx-libs
Commit 3de6bc74 authored by Ulrich Sibiller's avatar Ulrich Sibiller
Browse files
Options

Dialog.c: fix possible buffer overflows

Fix write past the end of singlePath if PATH contains dirs longer than PATH_MAX.
parent 4a345786
Hide whitespace changes
Inline Side-by-side
Showing with 13 additions and 0 deletions
nx-X11/programs/Xserver/hw/nxagent/Display.c
View file @ 3de6bc74
...@@ -1842,6 +1842,13 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission, ...@@ -1842,6 +1842,13 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
if (end != NULL) if (end != NULL)
{ {
if ((end - path) > sizeof(singlePath) - 1)
{
fprintf(stderr, "Warning: Path too long - ignored.\n");
path = end + 1;
continue;
}
strncpy(singlePath, path, (unsigned long)(end - path)); strncpy(singlePath, path, (unsigned long)(end - path));
singlePath[(unsigned long)(end - path)] = '\0'; singlePath[(unsigned long)(end - path)] = '\0';
...@@ -1850,6 +1857,12 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission, ...@@ -1850,6 +1857,12 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
} }
else else
{ {
if (strlen(path) > sizeof(singlePath) - 1)
{
fprintf(stderr, "Error: Path too long.\n");
return NULL;
}
strcpy(singlePath, path); strcpy(singlePath, path);
breakLoop = 1; breakLoop = 1;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment