From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sergey Vlasov Date: Thu, 01 Feb 2007 15:06:20 +0000 Subject: [PATCH 2/3] udev_rules_apply_format(): don't overflow the buffer when Message-Id: <1170342384945-git-send-email-vsu@altlinux.ru> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-hotplug@vger.kernel.org When truncating the substitution string to the length specified in the format string, head[len] = '\0' could write outside the buffer if that length was too large. Signed-off-by: Sergey Vlasov --- udev_rules.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/udev_rules.c b/udev_rules.c index 44b41e9..90a83e5 100644 --- a/udev_rules.c +++ b/udev_rules.c @@ -558,7 +558,7 @@ found: break; } /* possibly truncate to format-char specified length */ - if (len != -1) { + if (len >= 0 && (size_t)len < maxsize - (head-string)) { head[len] = '\0'; dbg("truncate to %i chars, subtitution string becomes '%s'", len, head); } -- 1.5.0.rc2.gd894fb ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier. Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net Linux-hotplug-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel