screen-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [screen-devel] [PATCH] Really avoid a potential buffer overflow for


From: david kerns
Subject: Re: [screen-devel] [PATCH] Really avoid a potential buffer overflow for 'home'
Date: Tue, 9 Jul 2024 07:41:53 -0700



On Tue, Jul 9, 2024 at 6:31 AM Vincent Lefevre <vincent@vinc17.net> wrote:

As said, you need Autoconf version 2.71 or higher.
You have only 2.69, which is very old:

> $ autoreconf --version
> autoreconf (GNU Autoconf) 2.69
> Copyright (C) 2012 Free Software Foundation, Inc.
[...]

well, not sure how to fix that

$ yum provides  /usr/bin/autoreconf
Last metadata expiration check: 0:57:11 ago on Tue 09 Jul 2024 06:17:12 AM MST.
autoconf-2.69-38.el9.noarch : A GNU tool for automatically configuring source code
Repo        : @System
Matched from:
Filename    : /usr/bin/autoreconf

autoconf-2.69-38.el9.noarch : A GNU tool for automatically configuring source code
Repo        : appstream
Matched from:
Filename    : /usr/bin/autoreconf

$ sudo yum update autoconf
Last metadata expiration check: 1:35:55 ago on Tue 09 Jul 2024 05:39:30 AM MST.
Dependencies resolved.
Nothing to do.
Complete!


so I hacked a Makefile from Makefile.in and created a minimal config.h to at least build (most) .o files
I've implemented this, there's a high probability you'll want something different :)

$ cat test.c
#ifdef SHOW_BUF_OVERFLOW
#define REPORT_SNPRINTF(wr,sz)  if (wr >= (int)(sz)) fprintf(stderr, "%s:%d: caught internal buffer overflow\n", __FILE__, __LINE__)
#else
#define REPORT_SNPRINTF(wr,sz) (void) wr
#endif // SHOW_BUF_OVERFLOW


#include <stdio.h>

int main()
{
  char buf[10];
  int max;

  max = snprintf(buf, sizeof(buf), "%s", "short"); REPORT_SNPRINTF(max, sizeof(buf));
  printf("%s\n", buf);

  max = snprintf(buf, sizeof(buf), "%s", "this string is too long to fit"); REPORT_SNPRINTF(max, sizeof(buf));
  printf("%s\n", buf);
 
  return 0;
}
$ cc     test.c   -o test -DSHOW_BUF_OVERFLOW
$ ./test
short
test.c:20: caught internal buffer overflow
this stri
$ cc     test.c   -o test
$ ./test
short
this stri


here's the patch... please review/scrutinize before accepting


Attachment: snprintf.patch
Description: Binary data


reply via email to

[Prev in Thread] Current Thread [Next in Thread]