Просмотр исходного кода

vm-file-editor: fix potential buffer overflow

If we're being sent something without a zero byte, we
could happily read off the end of the buffer. Interestingly,
the write part was checking for the max bound.
Vincent Penquerc'h 10 лет назад
Родитель
Сommit
11b8f9be20
1 измененных файлов с 2 добавлено и 1 удалено
  1. 2 1
      qubes-rpc/vm-file-editor.c

+ 2 - 1
qubes-rpc/vm-file-editor.c

@@ -28,11 +28,12 @@ char *get_filename()
 	int i;
 	if (!read_all(0, buf, sizeof(buf)))
 		exit(1);
+	buf[DVM_FILENAME_SIZE-1] = 0;
 	if (index(buf, '/')) {
 		fprintf(stderr, "filename contains /");
 		exit(1);
 	}
-	for (i=0; i < DVM_FILENAME_SIZE && buf[i]!=0; i++) {
+	for (i=0; buf[i]!=0; i++) {
 		// replace some characters with _ (eg mimeopen have problems with some of them)
 		if (index(" !?\"#$%^&*()[]<>;`~", buf[i]))
 			buf[i]='_';