sbase

suckless unix tools
git clone git://git.2f30.org/sbase
Log | Files | Refs | README | LICENSE

commit 5e4e6aeb3ee843f1fb1bc3de1c2e682f20c61625
parent 9e594a986eef7e589724f2f18a81e05c47cf70de
Author: Michael Forney <mforney@mforney.org>
Date:   Tue,  6 Dec 2016 02:16:54 -0800

od: Fix buffer overflow if -N flag is larger than BUFSIZ

Previously, if max was specified, od will call read with that size,
potentially overflowing buf with data read from the file.

Diffstat:
Mod.c | 18++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/od.c b/od.c @@ -129,23 +129,25 @@ od(FILE *fp, char *fname, int last) { static unsigned char *line; static size_t lineoff; - size_t i; - unsigned char buf[BUFSIZ]; static off_t addr; - size_t buflen; + unsigned char buf[BUFSIZ]; + size_t i, n, size = sizeof(buf); while (skip - addr > 0) { - buflen = fread(buf, 1, MIN(skip - addr, BUFSIZ), fp); - addr += buflen; + n = fread(buf, 1, MIN(skip - addr, sizeof(buf)), fp); + addr += n; if (feof(fp) || ferror(fp)) return; } if (!line) line = emalloc(linelen); - while ((buflen = fread(buf, 1, max >= 0 ? - max - (addr - skip) : BUFSIZ, fp))) { - for (i = 0; i < buflen; i++, addr++) { + for (;;) { + if (max >= 0) + size = MIN(max - (addr - skip), size); + if (!(n = fread(buf, 1, size, fp))) + break; + for (i = 0; i < n; i++, addr++) { line[lineoff++] = buf[i]; if (lineoff == linelen) { printline(line, lineoff, addr - lineoff + 1);