From: Stephen Hemminger <stephen@networkplumber.org>
To: netdev@vger.kernel.org
Cc: Stephen Hemminger <stephen@networkplumber.org>
Subject: [PATCH] utils: fix makeargs stack overflow
Date: Mon, 18 Dec 2017 11:15:46 -0800 [thread overview]
Message-ID: <20171218191546.29122-1-stephen@networkplumber.org> (raw)
The makeargs() function did not handle end of string correctly
and would reference past end of string.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
lib/utils.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/lib/utils.c b/lib/utils.c
index 7ced8c061cb0..df1f3b1238c0 100644
--- a/lib/utils.c
+++ b/lib/utils.c
@@ -1206,10 +1206,16 @@ ssize_t getcmdline(char **linep, size_t *lenp, FILE *in)
int makeargs(char *line, char *argv[], int maxargs)
{
static const char ws[] = " \t\r\n";
- char *cp;
+ char *cp = line;
int argc = 0;
- for (cp = line + strspn(line, ws); *cp; cp += strspn(cp, ws)) {
+ while (*cp) {
+ /* skip leading whitespace */
+ cp += strspn(cp, ws);
+
+ if (*cp == '\0')
+ break;
+
if (argc >= (maxargs - 1)) {
fprintf(stderr, "Too many arguments to command\n");
exit(1);
@@ -1226,13 +1232,16 @@ int makeargs(char *line, char *argv[], int maxargs)
fprintf(stderr, "Unterminated quoted string\n");
exit(1);
}
- *cp++ = 0;
- continue;
+ } else {
+ argv[argc++] = cp;
+
+ /* find end of word */
+ cp += strcspn(cp, ws);
+ if (*cp == '\0')
+ break;
}
- argv[argc++] = cp;
- /* find end of word */
- cp += strcspn(cp, ws);
+ /* seperate words */
*cp++ = 0;
}
argv[argc] = NULL;
--
2.11.0
reply other threads:[~2017-12-18 19:15 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171218191546.29122-1-stephen@networkplumber.org \
--to=stephen@networkplumber.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).