mirrors/zsh
1
0
Fork 0
mirror of git://git.code.sf.net/p/zsh/code synced 2025-09-11 13:01:28 +02:00
Code Releases Activity

42539: prevent overflow of PATH_MAX-sized buffer in spelling correction

Browse source
This commit is contained in:
Oliver Kiddle 2018-03-28 09:00:58 +02:00
parent fa0105f78c
commit c053c6a079
2 changed files with 14 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
2018-03-28 Oliver Kiddle <okiddle@yahoo.co.uk>
* 42539: Src/utils.c: prevent overflow of PATH_MAX-sized
buffer in spelling correction
2018-03-27 Peter Stephenson <p.stephenson@samsung.com> 2018-03-27 Peter Stephenson <p.stephenson@samsung.com>
* Martijn: 42538: Src/utils.c, Test/A04redirect.ztst: * Martijn: 42538: Src/utils.c, Test/A04redirect.ztst:

14
Src/utils.c
View file

@ -2287,7 +2287,8 @@ struncpy(char **s, char *t, int n)
{ {
char *u = *s; char *u = *s;
while (n-- && (*u++ = *t++)); while (n-- && (*u = *t++))
u++;
*s = u; *s = u;
if (n > 0) /* just one null-byte will do, unlike strncpy(3) */ if (n > 0) /* just one null-byte will do, unlike strncpy(3) */
*u = '\0'; *u = '\0';
@ -4424,17 +4425,20 @@ spname(char *oldname)
* odd to the human reader, and we may make use of the total * * odd to the human reader, and we may make use of the total *
* distance for all corrections at some point in the future. */ * distance for all corrections at some point in the future. */
if (bestdist < maxthresh) { if (bestdist < maxthresh) {
strcpy(new, spnameguess); struncpy(&new, spnameguess, sizeof(newname) - (new - newname));
strcat(new, old); struncpy(&new, old, sizeof(newname) - (new - newname));
return newname; return (new - newname) >= (sizeof(newname)-1) ? NULL : newname;
} else } else
return NULL; return NULL;
} else { } else {
maxthresh = bestdist + thresh; maxthresh = bestdist + thresh;
bestdist += thisdist; bestdist += thisdist;
} }
for (p = spnamebest; (*new = *p++);) for (p = spnamebest; (*new = *p++);) {
if ((new - newname) >= (sizeof(newname)-1))
return NULL;
new++; new++;
}
} }
} }