Blob Blame History Raw
autofs-5.1.0 - fix buffer size checks in get_network_proximity()

From: Ian Kent <raven@themaw.net>

Add several buffer size checks in get_network_proximity().
---
 CHANGELOG        |    1 +
 lib/parse_subs.c |    8 +++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

--- autofs-5.0.7.orig/CHANGELOG
+++ autofs-5.0.7/CHANGELOG
@@ -135,6 +135,7 @@
 - fix FILE pointer check in defaults_read_config().
 - fix memory leak in conf_amd_get_log_options().
 - fix signed comparison in inet_fill_net().
+- fix buffer size checks in get_network_proximity().
 
 25/07/2012 autofs-5.0.7
 =======================
--- autofs-5.0.7.orig/lib/parse_subs.c
+++ autofs-5.0.7/lib/parse_subs.c
@@ -437,7 +437,7 @@ unsigned int get_network_proximity(const
 {
 	struct addrinfo hints;
 	struct addrinfo *ni, *this;
-	char name_or_num[NI_MAXHOST];
+	char name_or_num[NI_MAXHOST + 1];
 	unsigned int proximity;
 	char *net;
 	int ret;
@@ -449,16 +449,18 @@ unsigned int get_network_proximity(const
 	if (net)
 		strcpy(name_or_num, net);
 	else {
-		char this[NI_MAXHOST];
+		char this[NI_MAXHOST + 1];
 		char *mask;
 
+		if (strlen(name) > NI_MAXHOST)
+			return PROXIMITY_ERROR;
 		strcpy(this, name);
 		if ((mask = strchr(this, '/')))
 			*mask++ = '\0';
 		if (!strchr(this, '.'))
 			strcpy(name_or_num, this);
 		else {
-			char buf[NI_MAXHOST], *new;
+			char buf[NI_MAXHOST + 1], *new;
 			new = inet_fill_net(this, buf);
 			if (!new)
 				return PROXIMITY_ERROR;