File mlterm-Fix-buffer-overflow-with-long-plugin-suf... of Package mlterm

Overview Repositories Revisions Requests Users Attributes Meta

File mlterm-Fix-buffer-overflow-with-long-plugin-suffix.patch of Package mlterm (Revision 1ff3520597bd00203de4fb30390f9ca6)

Currently displaying revision 1ff3520597bd00203de4fb30390f9ca6 , Show latest

From 90ced520f47ca46b00e889ecd9db81aa1426403d Mon Sep 17 00:00:00 2001
From: Michal Suchanek <msuchanek@suse.de>
Date: Fri, 24 Feb 2023 22:14:57 +0100
Subject: [PATCH] Fix buffer overflow with long plugin suffix

The buffer length for appending suffix to module name is not correctly
calculated. Fix the calculation to avoid memory corruption.

Signed-off-by: Michal Suchanek <msuchanek@suse.de>
---
 uitoolkit/ui_im.c              | 2 +-
 uitoolkit/ui_sb_view_factory.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/uitoolkit/ui_im.c b/uitoolkit/ui_im.c
index 18607291..754ddfe4 100644
--- a/uitoolkit/ui_im.c
+++ b/uitoolkit/ui_im.c
@@ -77,7 +77,7 @@ static int dlsym_im_new_func(char *im_name, ui_im_new_func_t *func, bl_dl_handle
   sprintf(symname, "im_%s_new", im_name);
 
 #ifdef PLUGIN_MODULE_SUFFIX
-  if ((im_name2 = alloca(strlen(im_name) + 3 + 1))) {
+  if ((im_name2 = alloca(strlen(im_name) + strlen(PLUGIN_MODULE_SUFFIX) + 2))) {
     sprintf(im_name2, "%s-" PLUGIN_MODULE_SUFFIX, im_name);
 
     if (!(*handle = im_dlopen(im_name2))) {
diff --git a/uitoolkit/ui_sb_view_factory.c b/uitoolkit/ui_sb_view_factory.c
index 66a9ebb6..16aeb5ae 100644
--- a/uitoolkit/ui_sb_view_factory.c
+++ b/uitoolkit/ui_sb_view_factory.c
@@ -48,7 +48,7 @@ static ui_sb_view_new_func_t dlsym_sb_view_new_func(const char *name, int is_tra
 #ifdef PLUGIN_MODULE_SUFFIX
   char *p;
 
-  if (!(p = alloca(strlen(name) + 3 + 1))) {
+  if (!(p = alloca(strlen(name) + strlen(PLUGIN_MODULE_SUFFIX) + 2))) {
     return NULL;
   }
 
@@ -98,7 +98,7 @@ static ui_sb_engine_new_func_t dlsym_sb_engine_new_func(const char *name) {
 #ifdef PLUGIN_MODULE_SUFFIX
   char *p;
 
-  if (!(p = alloca(strlen(name) + 3 + 1))) {
+  if (!(p = alloca(strlen(name) + strlen(PLUGIN_MODULE_SUFFIX) + 2))) {
     return NULL;
   }
 
-- 
2.39.2

Places

File mlterm-Fix-buffer-overflow-with-long-plugin-suffix.patch of Package mlterm (Revision 1ff3520597bd00203de4fb30390f9ca6)

Places