33 lines
942 B
Diff
33 lines
942 B
Diff
|
From d95b3d070009dc557d60ead60ab6d820fe8e7e7f Mon Sep 17 00:00:00 2001
|
||
|
|
From: rpm-build <rpm-build>
|
||
|
|
Date: Tue, 16 Nov 2021 14:32:46 +0800
|
||
|
|
Subject: [PATCH] lnstat: fix buffer overflow in lnstat command
|
||
|
|
|
||
|
|
segfults when called the following command:
|
||
|
|
[root@localhost ~]lnstat -w 1
|
||
|
|
Segmentation fault (core dumped)
|
||
|
|
|
||
|
|
The maximum value of th.num_lines is HDR_LINES(10),
|
||
|
|
h should not be equal to th.num_lines, array th.hdr may
|
||
|
|
be out of bounds.
|
||
|
|
---
|
||
|
|
misc/lnstat.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/misc/lnstat.c b/misc/lnstat.c
|
||
|
|
index e3c8421..7bfb8e6 100644
|
||
|
|
--- a/misc/lnstat.c
|
||
|
|
+++ b/misc/lnstat.c
|
||
|
|
@@ -210,7 +210,7 @@ static struct table_hdr *build_hdr_string(struct lnstat_file *lnstat_files,
|
||
|
|
ofs += width+1;
|
||
|
|
}
|
||
|
|
/* fill in spaces */
|
||
|
|
- for (h = 1; h <= th.num_lines; h++) {
|
||
|
|
+ for (h = 1; h < th.num_lines; h++) {
|
||
|
|
for (i = 0; i < ofs; i++) {
|
||
|
|
if (th.hdr[h][i] == '\0')
|
||
|
|
th.hdr[h][i] = ' ';
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|