1
0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-14 10:09:48 +00:00

Fix crash on parsing some inf files

ndiscvt uses 16 entry array for words into which it parses
comma-separated lists of strings, like AddReg line in

    [somesection]
        AddReg = foo.reg, bar.reg, baz.reg, quiz.reg

Overflows were not checked so it crashed on a line with 17 words
encountered in some Broadcom/Dell Wireless 1704 802.11b-g-n driver

So extend the array up to 32 entries and add an overflow check.

Reviewed by:	bapt
Approved by:	bapt
MFC after:	2 weeks
Differential Revision:	D3713
This commit is contained in:
Dmitry Marakasov 2015-09-22 16:59:41 +00:00
parent c9dbb1cc52
commit a40531fcf8
Notes: svn2git 2020-12-20 02:59:44 +00:00
svn path=/head/; revision=288120
2 changed files with 7 additions and 1 deletions

View File

@ -887,6 +887,12 @@ regkey_add (const char *r)
void
push_word (const char *w)
{
if (idx == W_MAX) {
fprintf(stderr, "too many words; try bumping W_MAX in inf.h\n");
exit(1);
}
if (w && strlen(w))
words[idx++] = w;
else

View File

@ -4,7 +4,7 @@
* $FreeBSD$
*/
#define W_MAX 16
#define W_MAX 32
struct section {
const char * name;