Attachment 84807 Details for Bug 66345 – correct handling of overlong keynames/strings

[patch] correct handling of overlong keynames/strings

0001-Making-sure-that-a-copied-string-is-always-null-term.patch (text/plain), 1.52 KB, created by Benno Schulenberg on 2013-08-28 18:20:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Benno Schulenberg

Created: 2013-08-28 18:20:34 UTC

Size: 1.52 KB

patch

obsolete

>From 20cc757ceebe15cf59c4a539707601496e8d828c Mon Sep 17 00:00:00 2001
>From: Benno Schulenberg <bensberg@justemail.net>
>Date: Wed, 28 Aug 2013 20:03:30 +0200
>Subject: [PATCH] Making sure that a copied string is always null-terminated (#66345).
>
>A more minimalistic and formally correct solution.
>This amends and extends the previous fix for bug #66345,
>fixing not just yyGetKeyName() but also yyGetString().
>
>Signed-off-by: Benno Schulenberg <bensberg@justemail.net>
>---
> xkbscan.c |   14 ++------------
> 1 files changed, 2 insertions(+), 12 deletions(-)
>
>diff --git a/xkbscan.c b/xkbscan.c
>index 144f315..237f520 100644
>--- a/xkbscan.c
>+++ b/xkbscan.c
>@@ -388,9 +388,9 @@ yyGetString(void)
>         if (i < sizeof(scanBuf) - 1)
>             scanBuf[i++] = ch;
>     }
>+    scanBuf[i] = '\0';
>     if (ch == '"')
>     {
>-        scanBuf[i++] = '\0';
>         scanStrLine = lineNum;
>         return STRING;
>     }
>@@ -401,7 +401,6 @@ static int
> yyGetKeyName(void)
> {
>     int ch, i;
>-    int last;
> 
>     i = 0;
>     while (((ch = scanchar()) != EOF) && (ch != '>'))
>@@ -463,24 +462,15 @@ yyGetKeyName(void)
>             else
>                 return ERROR_TOK;
>         }
>-
>         if (i < sizeof(scanBuf) - 1)
>             scanBuf[i++] = ch;
>     }
>-
>-    if (i < sizeof(scanBuf) - i)
>-        last = i;
>-    else
>-        last = sizeof(scanBuf) - 1;
>-
>-    scanBuf[last] = '\0';
>-
>+    scanBuf[i] = '\0';
>     if ((ch == '>') && (i < 5))
>     {
>         scanStrLine = lineNum;
>         return KEYNAME;
>     }
>-
>     return ERROR_TOK;
> }
> 
>-- 
>1.7.0.4
>

Actions: View | Splinter Review

Attachments on bug 66345: 84807

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.