[PATCH 2/3] udev_rules_apply_format(): don't overflow the buffer when

[Sergey Vlasov <vsu@altlinux.ru>]

When truncating the substitution string to the length specified in the
format string, head[len] = '\0' could write outside the buffer if that
length was too large.

Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
---
 udev_rules.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/udev_rules.c b/udev_rules.c
index 44b41e9..90a83e5 100644
--- a/udev_rules.c
+++ b/udev_rules.c
@@ -558,7 +558,7 @@ found:
 			break;
 		}
 		/* possibly truncate to format-char specified length */
-		if (len != -1) {
+		if (len >= 0 && (size_t)len < maxsize - (head-string)) {
 			head[len] = '\0';
 			dbg("truncate to %i chars, subtitution string becomes '%s'", len, head);
 		}
-- 
1.5.0.rc2.gd894fb


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid\x120709&bid&3057&dat\x121642
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel