drew
/
acadia-newlib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Cygwin: console: Prevent buffer overrun. 

- This patch prevent potential buffer overrun in the code handling
  escape sequences.
This commit is contained in:
Takashi Yano 2020-03-02 10:12:56 +09:00 committed by Corinna Vinschen
parent 10d8c2782d
commit 750cd6e5b2
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
winsup/cygwin/fhandler_console.cc
View File

@ -3094,7 +3094,8 @@ fhandler_console::write (const void *vsrc, size_t len)
case gotarg1: case gotarg1:
if (isdigit (*src)) if (isdigit (*src))
{ {
con.args[con.nargs] = con.args[con.nargs] * 10 + *src - '0'; if (con.nargs < MAXARGS)
con.args[con.nargs] = con.args[con.nargs] * 10 + *src - '0';
wpbuf_put (*src); wpbuf_put (*src);
src++; src++;
} }
@ -3102,9 +3103,8 @@ fhandler_console::write (const void *vsrc, size_t len)
{ {
wpbuf_put (*src); wpbuf_put (*src);
src++; src++;
con.nargs++; if (con.nargs < MAXARGS)
if (con.nargs > MAXARGS) con.nargs++;
con.nargs--;
} }
else if (*src == ' ') else if (*src == ' ')
{ {
@ -3117,9 +3117,8 @@ fhandler_console::write (const void *vsrc, size_t len)
con.state = gotcommand; con.state = gotcommand;
break; break;
case gotcommand: case gotcommand:
con.nargs ++; if (con.nargs < MAXARGS)
if (con.nargs > MAXARGS) con.nargs++;
con.nargs--;
char_command (*src++); char_command (*src++);
con.state = normal; con.state = normal;
wpixput = 0; wpixput = 0;
@ -3183,9 +3182,8 @@ fhandler_console::write (const void *vsrc, size_t len)
{ {
con.state = gotarg1; con.state = gotarg1;
wpbuf_put (*src); wpbuf_put (*src);
con.nargs++; if (con.nargs < MAXARGS)
if (con.nargs > MAXARGS) con.nargs++;
con.nargs--;
src++; src++;
} }
else if (isalpha (*src)) else if (isalpha (*src))