cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a core dump when doing 'tosha -i'. (Maintainer timeout after about two

Browse Source 
months.)

The problem is in resolve_extension().  strncpy() will only null-terminate
the destination string if it has enough room, according to the given
length.

In this implementation, there will never be enough room to null-terminate
the string, from what I can tell.  So if the memory in 'tmpstr' contains
non-nulls, you'll get a core-dump in the subsequent strcat().
This commit is contained in:
Kenneth D. Merry 2001-02-07 20:19:53 +00:00
parent 5f46ac1988
commit 664211684a
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=38076
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
audio/tosha/files/patch-aa Normal file
View File

@ -0,0 +1,23 @@
*** tosha.c.orig Fri Jan 1 16:57:49 1999
--- tosha.c Sun Dec 10 01:04:54 2000
***************
*** 240,247 ****
return template;
if (!(tmpstr = malloc(strlen(template) + strlen(formatspec->ext) - 1)))
out_of_memory();
! if ((prefix = cptr - template))
strncpy (tmpstr, template, prefix);
strcat (tmpstr + prefix, formatspec->ext);
prefix += strlen(formatspec->ext);
strcat (tmpstr + prefix, cptr + 2);
--- 240,249 ----
return template;
if (!(tmpstr = malloc(strlen(template) + strlen(formatspec->ext) - 1)))
out_of_memory();
! if ((prefix = cptr - template)) {
strncpy (tmpstr, template, prefix);
+ tmpstr[prefix] = '\0';
+ }
strcat (tmpstr + prefix, formatspec->ext);
prefix += strlen(formatspec->ext);
strcat (tmpstr + prefix, cptr + 2);