gryf/wmaker
1
0
Fork 0
mirror of https://github.com/gryf/wmaker.git synced 2026-01-03 20:34:14 +01:00
Code Issues Projects Releases Wiki Activity

Menu parser: added boundary checks in the path-gen for #include file search

Browse Source 
When generating the full path+name of file to search for a file
being #included, it was generated in a buffer that's supposedly
large enough (MAXLINE > 2*PATH_MAX). However, this limit has a few
issues (PATH_MAX seem to be able to be bigger, and worse: we can't
be sure we're given longer args).

The code was rewrote to natively include boundary checks so we're
sure we won't overflow the buffer. A few strncpy have been removed
because in this case they tend to make things harder to write.
This commit is contained in:
Christophe CURIS
2012-07-18 00:02:22 +02:00
committed by Carlos R. Mafra
parent ac52d4de65
commit 9ad278ddf8
1 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
WINGs/menuparser.c
View File

@@ -474,22 +474,31 @@ static Bool menu_parser_include_file(WMenuParser parser)
if (fh == NULL) { if (fh == NULL) {
if (req_filename[0] != '/') { if (req_filename[0] != '/') {
const char *src; const char *src;
int idx;
fullfilename = buffer; fullfilename = buffer;
src = parser->include_default_paths; src = parser->include_default_paths;
while (*src != '\0') { while (*src != '\0') {
p = buffer; idx = 0;
if (*src == '~') { if (*src == '~') {
char *home = wgethomedir(); char *home = wgethomedir();
while (*home != '\0') while (*home != '\0') {
*p++ = *home++; if (idx < sizeof(buffer) - 2)
buffer[idx++] = *home;
home++;
}
src++; src++;
} }
while ((*src != '\0') && (*src != ':')) while ((*src != '\0') && (*src != ':')) {
*p++ = *src++; if (idx < sizeof(buffer) - 2)
*p++ = '/'; buffer[idx++] = *src;
strncpy(p, req_filename, sizeof(buffer) - (p - buffer - 1)); src++;
buffer[sizeof(buffer) - 1] = '\0'; }
buffer[idx++] = '/';
for (p = req_filename; *p != '\0'; p++)
if (idx < sizeof(buffer) - 1)
buffer[idx++] = *p;
buffer[idx] = '\0';
fh = fopen(fullfilename, "rb"); fh = fopen(fullfilename, "rb");
if (fh != NULL) goto found_valid_file; if (fh != NULL) goto found_valid_file;