Răsfoiți Sursa

vm-file-editor: fix potential buffer overflow

If we're being sent something without a zero byte, we
could happily read off the end of the buffer. Interestingly,
the write part was checking for the max bound.
Vincent Penquerc'h 10 ani în urmă
părinte
comite
11b8f9be20
1 a modificat fișierele cu 2 adăugiri și 1 ștergeri
  1. 2 1
      qubes-rpc/vm-file-editor.c

+ 2 - 1
qubes-rpc/vm-file-editor.c

@@ -28,11 +28,12 @@ char *get_filename()
 	int i;
 	if (!read_all(0, buf, sizeof(buf)))
 		exit(1);
+	buf[DVM_FILENAME_SIZE-1] = 0;
 	if (index(buf, '/')) {
 		fprintf(stderr, "filename contains /");
 		exit(1);
 	}
-	for (i=0; i < DVM_FILENAME_SIZE && buf[i]!=0; i++) {
+	for (i=0; buf[i]!=0; i++) {
 		// replace some characters with _ (eg mimeopen have problems with some of them)
 		if (index(" !?\"#$%^&*()[]<>;`~", buf[i]))
 			buf[i]='_';