فهرست منبع

vm-file-editor: fix potential buffer overflow

If we're being sent something without a zero byte, we
could happily read off the end of the buffer. Interestingly,
the write part was checking for the max bound.
Vincent Penquerc'h 10 سال پیش
والد
کامیت
11b8f9be20
1فایلهای تغییر یافته به همراه2 افزوده شده و 1 حذف شده
  1. 2 1
      qubes-rpc/vm-file-editor.c

+ 2 - 1
qubes-rpc/vm-file-editor.c

@@ -28,11 +28,12 @@ char *get_filename()
 	int i;
 	if (!read_all(0, buf, sizeof(buf)))
 		exit(1);
+	buf[DVM_FILENAME_SIZE-1] = 0;
 	if (index(buf, '/')) {
 		fprintf(stderr, "filename contains /");
 		exit(1);
 	}
-	for (i=0; i < DVM_FILENAME_SIZE && buf[i]!=0; i++) {
+	for (i=0; buf[i]!=0; i++) {
 		// replace some characters with _ (eg mimeopen have problems with some of them)
 		if (index(" !?\"#$%^&*()[]<>;`~", buf[i]))
 			buf[i]='_';