mirror of
https://git.FreeBSD.org/src.git
synced 2024-12-14 10:09:48 +00:00
Fix crash on parsing some inf files
ndiscvt uses 16 entry array for words into which it parses comma-separated lists of strings, like AddReg line in [somesection] AddReg = foo.reg, bar.reg, baz.reg, quiz.reg Overflows were not checked so it crashed on a line with 17 words encountered in some Broadcom/Dell Wireless 1704 802.11b-g-n driver So extend the array up to 32 entries and add an overflow check. Reviewed by: bapt Approved by: bapt MFC after: 2 weeks Differential Revision: D3713
This commit is contained in:
parent
c9dbb1cc52
commit
a40531fcf8
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=288120
@ -887,6 +887,12 @@ regkey_add (const char *r)
|
||||
void
|
||||
push_word (const char *w)
|
||||
{
|
||||
|
||||
if (idx == W_MAX) {
|
||||
fprintf(stderr, "too many words; try bumping W_MAX in inf.h\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (w && strlen(w))
|
||||
words[idx++] = w;
|
||||
else
|
||||
|
@ -4,7 +4,7 @@
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#define W_MAX 16
|
||||
#define W_MAX 32
|
||||
|
||||
struct section {
|
||||
const char * name;
|
||||
|
Loading…
Reference in New Issue
Block a user