isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reallocate the buffer correctly when appending a newline.

Browse Source 
Fixes a potential buffer overflow introduced in the last commit.
This commit is contained in:
Todd C. Miller
2021-02-03 15:13:03 -07:00
parent b4cabdb394
commit 10e37223b5
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/sudoers/toke.c
View File

@@ -5472,14 +5472,14 @@ sudoers_input(char *buf, yy_size_t max_size)
/* Add trailing newline if it is missing. */ /* Add trailing newline if it is missing. */
if (sudolinebuf.buf[avail - 1] != '\n') { if (sudolinebuf.buf[avail - 1] != '\n') {
if (avail == sudolinebuf.size) { if (avail + 2 >= sudolinebuf.size) {
char *cp = realloc(sudolinebuf.buf, avail + 1); char *cp = realloc(sudolinebuf.buf, avail + 2);
if (cp == NULL) { if (cp == NULL) {
YY_FATAL_ERROR("unable to allocate memory"); YY_FATAL_ERROR("unable to allocate memory");
return 0; return 0;
} }
sudolinebuf.buf = cp; sudolinebuf.buf = cp;
sudolinebuf.size++; sudolinebuf.size = avail + 2;
} }
sudolinebuf.buf[avail++] = '\n'; sudolinebuf.buf[avail++] = '\n';
sudolinebuf.buf[avail] = '\0'; sudolinebuf.buf[avail] = '\0';

6
plugins/sudoers/toke.l
View File

@@ -1277,14 +1277,14 @@ sudoers_input(char *buf, yy_size_t max_size)
/* Add trailing newline if it is missing. */ /* Add trailing newline if it is missing. */
if (sudolinebuf.buf[avail - 1] != '\n') { if (sudolinebuf.buf[avail - 1] != '\n') {
if (avail == sudolinebuf.size) { if (avail + 2 >= sudolinebuf.size) {
char *cp = realloc(sudolinebuf.buf, avail + 1); char *cp = realloc(sudolinebuf.buf, avail + 2);
if (cp == NULL) { if (cp == NULL) {
YY_FATAL_ERROR("unable to allocate memory"); YY_FATAL_ERROR("unable to allocate memory");
return 0; return 0;
} }
sudolinebuf.buf = cp; sudolinebuf.buf = cp;
sudolinebuf.size++; sudolinebuf.size = avail + 2;
} }
sudolinebuf.buf[avail++] = '\n'; sudolinebuf.buf[avail++] = '\n';
sudolinebuf.buf[avail] = '\0'; sudolinebuf.buf[avail] = '\0';