Attachment 21848 Details for Bug 19490 – handles other crashing strcpy's

[patch] handles other crashing strcpy's

fortify-crash.diff (text/plain), 2.65 KB, created by Kees Cook on 2009-01-09 17:24:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kees Cook

Created: 2009-01-09 17:24:06 UTC

Size: 2.65 KB

patch

obsolete

>Ubuntu: https://bugs.launchpad.net/ubuntu/+source/x11-xkb-utils/+bug/309013
>Upstream: https://bugs.freedesktop.org/show_bug.cgi?id=19490
>Description: static buffer gets overflowed when running "xkbcomp -C :0"
>Index: libxkbfile-1.0.5/src/cout.c
>===================================================================
>--- libxkbfile-1.0.5.orig/src/cout.c	2009-01-09 17:14:42.000000000 -0800
>+++ libxkbfile-1.0.5/src/cout.c	2009-01-09 17:21:48.000000000 -0800
>@@ -132,13 +132,16 @@
> register unsigned 	i,n;
> XkbKeyTypePtr		type;
> Atom *			names;
>-char			prefix[32];
>+char *			prefix = NULL;
> 
>     fprintf(file,"\n\nstatic void\n");
>     fprintf(file,"initTypeNames(DPYTYPE dpy)\n");
>     fprintf(file,"{\n");
>     for (i=0,type=xkb->map->types;i<xkb->map->num_types;i++,type++) {
>-	strcpy(prefix,XkbAtomText(dpy,type->name,XkbCFile));
>+	if (asprintf(&prefix, "%s", XkbAtomText(dpy,type->name,XkbCFile))<0) {
>+		perror("asprintf");
>+		exit(1);
>+	}
> 	if (type->name!=None)
> 	    fprintf(file,"    dflt_types[%d].name= GET_ATOM(dpy,\"%s\");\n",i,
> 					XkbAtomText(dpy,type->name,XkbCFile));
>@@ -155,6 +158,8 @@
> 		fprintf(file,"GET_ATOM(dpy,\"%s\");\n",tmp);
> 	    }
> 	}
>+	free(prefix);
>+	prefix = NULL;
>     }
>     fprintf(file,"}\n");
>     return;
>@@ -166,7 +171,7 @@
> register unsigned	i,n;
> XkbClientMapPtr		map;
> XkbKeyTypePtr		type;
>-char 			prefix[32];
>+char * 			prefix = NULL;
> 
>     if ((!xkb)||(!xkb->map)||(!xkb->map->types)) {
> 	_XkbLibError(_XkbErrMissingTypes,"WriteCHdrKeyTypes",0);
>@@ -182,7 +187,10 @@
> 				XkbAtomText(dpy,xkb->names->types,XkbCFile));
>     }
>     for (i=0,type=map->types;i<map->num_types;i++,type++) {
>-	strcpy(prefix,XkbAtomText(dpy,type->name,XkbCFile));
>+	if (asprintf(&prefix, "%s", XkbAtomText(dpy,type->name,XkbCFile))<0) {
>+		perror("asprintf");
>+		exit(1);
>+	}
> 
> 	if (type->map_count>0) {
> 	    XkbKTMapEntryPtr	entry;
>@@ -209,10 +217,15 @@
> 							 type->num_levels);
> 	}
> 	fprintf(file,"\n");
>+	free(prefix);
>+	prefix = NULL;
>     }
>     fprintf(file,"static XkbKeyTypeRec dflt_types[]= {\n");
>     for (i=0,type=map->types;i<(unsigned)map->num_types;i++,type++) {
>-	strcpy(prefix,XkbAtomText(dpy,type->name,XkbCFile));
>+	if (asprintf(&prefix, "%s", XkbAtomText(dpy,type->name,XkbCFile))<0) {
>+		perror("asprintf");
>+		exit(1);
>+	}
> 	if (i!=0)	fprintf(file,",\n");
> 	fprintf(file,"    {\n	{ %15s, %15s, %15s },\n",
> 			XkbModMaskText(type->mods.mask,XkbCFile),
>@@ -229,6 +242,8 @@
> 	if (type->level_names!=NULL)
> 	     fprintf(file,"	None,	lnames_%s\n    }",prefix);
> 	else fprintf(file,"	None,	NULL\n    }");
>+	free(prefix);
>+	prefix = NULL;
>     }
>     fprintf(file,"\n};\n");
>     fprintf(file,"#define num_dflt_types (sizeof(dflt_types)/sizeof(XkbKeyTypeRec))\n");

Actions: View | Splinter Review

Attachments on bug 19490: 21847 | 21848 | 21912 | 21913 | 21956

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.