92208e6cc1
Buffer overflow in GNU screen allows privilege escalation for local users. It also has some potential for attackers getting control of another user's screen. Transfer of approximately two gigabytes of data is required to exploit this vulnerability. Usually screen is installed either setgid-utmp or setuid-root but this DOES NOT happen on OpenBSD, thus the reliability fix. ok brad@
13 lines
520 B
Plaintext
13 lines
520 B
Plaintext
$OpenBSD: patch-ansi_c,v 1.1 2003/12/04 23:27:07 margarida Exp $
|
|
--- ansi.c.orig 2003-11-28 00:27:43.000000000 +0000
|
|
+++ ansi.c 2003-11-28 00:28:29.000000000 +0000
|
|
@@ -559,7 +559,7 @@ register int len;
|
|
{
|
|
case '0': case '1': case '2': case '3': case '4':
|
|
case '5': case '6': case '7': case '8': case '9':
|
|
- if (curr->w_NumArgs < MAXARGS)
|
|
+ if (curr->w_NumArgs >= 0 && curr->w_NumArgs < MAXARGS)
|
|
{
|
|
if (curr->w_args[curr->w_NumArgs] < 100000000)
|
|
curr->w_args[curr->w_NumArgs] =
|