Re: [PATCH] fix buffer overflow in util_run_program()

[Andrey Borzenkov <arvidjaar@mail.ru>]

[-- Attachment #1: Type: text/plain, Size: 784 bytes --]

On Friday 04 of September 2009 23:54:14 Florian Zumbiehl wrote:
> Hi,
> 
> ...
> 
> Reading your high-quality code starts getting a bit boring, so I
>  guess that I won't waste any more of your valuable time for now,
>  except for finishing the threads I started.
> 
> Florian
> 
> diff --git a/libudev/libudev-util-private.c
>  b/libudev/libudev-util-private.c index 64203a8..c309945 100644
> --- a/libudev/libudev-util-private.c
> +++ b/libudev/libudev-util-private.c
> @@ -268,7 +268,7 @@ int util_run_program(struct udev *udev, const
>  char *command, char **envp, pid_t pid;
>  	char arg[UTIL_PATH_SIZE];
>  	char program[UTIL_PATH_SIZE];
> -	char *argv[(sizeof(arg) / 2) + 1];
> +	char *argv[sizeof(arg) + 1];

Could you give example when this overflows?

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]