mirrors/libguestfs
1
0
Fork 0
mirror of https://github.com/libguestfs/libguestfs.git synced 2026-03-21 22:53:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

sfdisk: guard against buffer overflow

Browse Source 
* daemon/sfdisk.c (sfdisk): Don't let outrageous "extra_flag"
or "device" strings overflow a fixed-size buffer.
This commit is contained in:
Jim Meyering
2009-08-12 21:16:30 +02:00
parent a0bb8e69de
commit bd34e4e942
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
daemon/sfdisk.c
View File

@@ -48,10 +48,23 @@ sfdisk (const char *device, int n, int cyls, int heads, int sectors,
sprintf (buf + strlen (buf), " -H %d", heads);
if (sectors)
sprintf (buf + strlen (buf), " -S %d", sectors);
if (extra_flag)
sprintf (buf + strlen (buf), " %s", extra_flag);
/* Safe because of RESOLVE_DEVICE above: */
/* The above are all guaranteed to fit in the fixed-size buffer.
However, extra_flag and device have no restrictions,
so we must check. */
if (extra_flag) {
if (strlen (buf) + 1 + strlen (extra_flag) >= sizeof buf) {
reply_with_error ("internal buffer overflow: sfdisk extra_flag too long");
return -1;
}
sprintf (buf + strlen (buf), " %s", extra_flag);
}
if (strlen (buf) + 1 + strlen (device) >= sizeof buf) {
reply_with_error ("internal buffer overflow: sfdisk device name too long");
return -1;
}
sprintf (buf + strlen (buf), " %s", device);
if (verbose)