rpms/cscope
7
0
Fork 0
Code Issues Pull Requests Releases Activity
02833f2901
cscope/cscope-15.5-fscanf-overflows.patch
Neil Horman 6eb1cd792b Resolves: bz 230862
2007-03-05 18:15:00 +00:00

209 lines
8.3 KiB
Diff
Raw Blame History

--- cscope-15.5/src/display.c.orig 2007-03-05 12:01:59.000000000 -0500
+++ cscope-15.5/src/display.c 2007-03-05 12:02:10.000000000 -0500
@@ -217,7 +217,7 @@ display(void)
disprefs < mdisprefs && screenline <= lastdispline;
++disprefs, ++screenline) {
/* read the reference line */
- if (fscanf(refsfound, "%s%s%s %[^\n]", file, function,
+ if (fscanf(refsfound, "%" PATHLEN_STR "s%" PATHLEN_STR "s%" NUMLEN_STR "s %" TEMPSTRING_LEN_STR "[^\n]", file, function,
linenum, tempstring) < 4) {
break;
}
--- cscope-15.5/src/build.c.orig 2007-03-05 12:01:59.000000000 -0500
+++ cscope-15.5/src/build.c 2007-03-05 12:02:10.000000000 -0500
@@ -115,7 +115,7 @@ samelist(FILE *oldrefs, char **names, in
}
/* see if the name list is the same */
for (i = 0; i < count; ++i) {
- if (fscanf(oldrefs, "%s", oldname) != 1 ||
+ if (! fgets(oldname, sizeof(oldname), oldrefs)||
strnotequal(oldname, names[i])) {
return(NO);
}
@@ -223,8 +223,8 @@ build(void)
/* if there is an old cross-reference and its current directory matches */
/* or this is an unconditional build */
if ((oldrefs = vpfopen(reffile, "rb")) != NULL && unconditional == NO &&
- fscanf(oldrefs, "cscope %d %s", &fileversion, olddir) == 2 &&
- (strcmp(olddir, currentdir) == 0 || /* remain compatible */
+ fscanf(oldrefs, "cscope %d %" PATHLEN_STR "s", &fileversion, olddir) == 2
+ && (strcmp(olddir, currentdir) == 0 || /* remain compatible */
strcmp(olddir, newdir) == 0)) {
/* get the cross-reference file's modification time */
(void) fstat(fileno(oldrefs), &statstruct);
@@ -292,7 +292,7 @@ build(void)
/* see if the list of source files is the same and
none have been changed up to the included files */
for (i = 0; i < nsrcfiles; ++i) {
- if (fscanf(oldrefs, "%s", oldname) != 1 ||
+ if (! fgets(oldname, sizeof(oldname), oldrefs) ||
strnotequal(oldname, srcfiles[i]) ||
lstat(srcfiles[i], &statstruct) != 0 ||
statstruct.st_mtime > reftime) {
@@ -301,7 +301,7 @@ build(void)
}
/* the old cross-reference is up-to-date */
/* so get the list of included files */
- while (i++ < oldnum && fscanf(oldrefs, "%s", oldname) == 1) {
+ while (i++ < oldnum && fgets(oldname, sizeof(oldname), oldrefs)) {
addsrcfile(oldname);
}
(void) fclose(oldrefs);
--- cscope-15.5/src/dir.c.orig 2003-06-02 06:43:00.000000000 -0400
+++ cscope-15.5/src/dir.c 2007-03-05 12:02:10.000000000 -0500
@@ -319,7 +319,7 @@ makefilelist(void)
/* Parse whitespace-terminated strings in line: */
point_in_line = line;
- while (sscanf(point_in_line, "%s", path) == 1) {
+ while (sscanf(point_in_line, "%" PATHLEN_STR "s", path) == 1) {
/* Have to store this length --- inviewpath() will
* modify path, later! */
length_of_name = strlen(path);
--- cscope-15.5/src/edit.c.orig 2001-07-18 09:49:01.000000000 -0400
+++ cscope-15.5/src/edit.c 2007-03-05 12:02:10.000000000 -0500
@@ -60,7 +60,7 @@ editref(int i)
seekline(i + topline);
/* get the file name and line number */
- if (fscanf(refsfound, "%s%*s%s", file, linenum) == 2) {
+ if (fscanf(refsfound, "%" PATHLEN_STR "s%*s%" NUMLEN_STR "s", file, linenum) == 2) {
edit(file, linenum); /* edit it */
}
seekline(topline); /* restore the line pointer */
@@ -83,7 +83,7 @@ editall(void)
seekline(1);
/* get each file name and line number */
- while (fscanf(refsfound, "%s%*s%s%*[^\n]", file, linenum) == 2) {
+ while (fscanf(refsfound, "%" PATHLEN_STR "s%*s%" NUMLEN_STR "s%*[^\n]", file, linenum) == 2) {
edit(file, linenum); /* edit it */
if (editallprompt == YES) {
addstr("Type ^D to stop editing all lines, or any other character to continue: ");
--- cscope-15.5/src/input.c.orig 2007-03-05 12:01:59.000000000 -0500
+++ cscope-15.5/src/input.c 2007-03-05 12:02:10.000000000 -0500
@@ -293,16 +293,15 @@ shellpath(char *out, int limit, char *in
/* if the login name is null, then use $HOME */
if (*out == '\0') {
v = getenv("HOME");
- }
- else { /* get the home directory of the login name */
+ } else { /* get the home directory of the login name */
v = logdir(out);
}
- /* copy the directory name */
- if (v != NULL) {
+ /* copy the directory name if it isn't too big */
+ if (v != NULL && strlen(v) < (lastchar - out)) {
(void) strcpy(out - 1, v);
out += strlen(v) - 1;
- }
- else { /* login not found, so ~ must be part of the file name */
+ } else {
+ /* login not found, so ~ must be part of the file name */
out += strlen(out);
}
}
@@ -322,11 +321,11 @@ shellpath(char *out, int limit, char *in
*s = '\0';
/* get its value */
- if ((v = getenv(out)) != NULL) {
+ if ((v = getenv(out)) != NULL && strlen(v) < (lastchar - out)) {
(void) strcpy(out - 1, v);
out += strlen(v) - 1;
- }
- else { /* var not found, so $ must be part of the file name */
+ } else {
+ /* var not found, so $ must be part of the file name */
out += strlen(out);
}
}
--- cscope-15.5/src/main.c.orig 2007-03-05 12:01:59.000000000 -0500
+++ cscope-15.5/src/main.c 2007-03-05 12:02:10.000000000 -0500
@@ -102,10 +102,10 @@ BOOL select_large = NO; /* enable more t
#endif
char temp1[PATHLEN + 1]; /* temporary file name */
char temp2[PATHLEN + 1]; /* temporary file name */
-char tempdirpv[PATHLEN +1]; /* private temp directory */
+char tempdirpv[PATHLEN + 1]; /* private temp directory */
long totalterms; /* total inverted index terms */
BOOL trun_syms; /* truncate symbols to 8 characters */
-char tempstring[8192]; /* use this as a buffer, instead of 'yytext',
+char tempstring[TEMPSTRING_LEN + 1]; /* use this as a buffer, instead of 'yytext',
* which had better be left alone */
char *tmpdir; /* temporary directory */
@@ -264,6 +264,13 @@ main(int argc, char **argv)
s[11] = '\0';
}
#endif
+ if (strlen(reffile) > sizeof(path) - 1) {
+ char buffer[512];
+ sprintf(buffer,"cscope: reffile too long, cannot be > %d characters\n", sizeof(path) - 1);
+ postmsg(buffer);
+ myexit(1);
+ /* NOTREACHED */
+ }
s = path + strlen(path);
(void) strcpy(s, ".in");
invname = stralloc(path);
@@ -491,11 +498,11 @@ lastarg:
|| (names = vpfopen(NAMEFILE, "r")) != NULL) {
/* read any -p option from it */
- while (fscanf(names, "%s", path) == 1 && *path == '-') {
+ while (fgets(path, sizeof(path), names) != NULL && *path == '-') {
i = path[1];
s = path + 2; /* for "-Ipath" */
if (*s == '\0') { /* if "-I path" */
- (void) fscanf(names, "%s", path);
+ fgets(path, sizeof(path), names);
s = path;
}
switch (i) {
@@ -512,7 +519,7 @@ lastarg:
}
else {
for (i = 0; i < nsrcfiles; ++i) {
- if (fscanf(oldrefs, "%s", path) != 1) {
+ if (!fgets(path, sizeof(path), oldrefs) ) {
posterr("cscope: cannot read source file name from file %s\n", reffile);
myexit(1);
}
--- cscope-15.5/src/command.c.orig 2007-03-05 12:01:59.000000000 -0500
+++ cscope-15.5/src/command.c 2007-03-05 12:02:10.000000000 -0500
@@ -727,7 +727,7 @@ changestring(void)
(void) fprintf(script, "ed - <<\\!\n");
*oldfile = '\0';
seekline(1);
- for (i = 0; fscanf(refsfound, "%s%*s%s%*[^\n]", newfile, linenum) == 2;
+ for (i = 0; fscanf(refsfound, "%" PATHLEN_STR "s%*s%" NUMLEN_STR "s%*[^\n]", newfile, linenum) == 2;
++i) {
/* see if the line is to be changed */
if (change[i] == YES) {
--- cscope-15.5/src/constants.h.orig 2007-03-05 12:01:59.000000000 -0500
+++ cscope-15.5/src/constants.h 2007-03-05 12:02:10.000000000 -0500
@@ -68,6 +68,7 @@
#define NUMLEN 5 /* line number length */
#define PATHLEN 250 /* file pathname length */
#define PATLEN 250 /* symbol pattern length */
+#define TEMPSTRING_LEN 8191 /* max strlen() of the global temp string */
#define REFFILE "cscope.out" /* cross-reference output file */
#define NAMEFILE "cscope.files" /* default list-of-files file */
#define INVNAME "cscope.in.out" /* inverted index to the database */
@@ -77,6 +78,13 @@
#define STMTMAX 10000 /* maximum source statement length */
+#define STR2(x) #x
+#define STRINGIZE(x) STR2(x)
+#define PATLEN_STR STRINGIZE(PATLEN)
+#define PATHLEN_STR STRINGIZE(PATHLEN)
+#define NUMLEN_STR STRINGIZE(NUMLEN)
+#define TEMPSTRING_LEN_STR STRINGIZE(TEMPSTRING_LEN)
+
/* screen lines */
#define FLDLINE (LINES - FIELDS - 1) /* first input field line */
#define MSGLINE 0 /* message line */
Reference in New Issue View Git Blame Copy Permalink