emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

Fix is_my_tty() buffer overrun

Browse Source 
*  libmisc/utmp.c (is_my_tty): Declare the parameter as a char array,
   not char *, as it is not necessarily null-terminated.
   Avoid a read overrun when reading 'tty', which comes from
   'ut_utname'.

Reported-by: Paul Eggert <eggert@cs.ucla.edu>
Co-developed-by: Paul Eggert <eggert@cs.ucla.edu>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
This commit is contained in:
Alejandro Colomar 2023-03-13 00:41:00 +01:00 committed by Iker Pedrosa
parent 664d361fa5
commit e27ca53091
1 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libmisc/utmp.c
View File

@ -28,17 +28,16 @@
/* /*
* is_my_tty -- determine if "tty" is the same TTY stdin is using * is_my_tty -- determine if "tty" is the same TTY stdin is using
*/ */
static bool is_my_tty (const char *tty) static bool is_my_tty (const char tty[UT_LINESIZE])
{ {
/* full_tty shall be at least sizeof utmp.ut_line + 5 */ char full_tty[STRLEN("/dev/") + UT_LINESIZE + 1];
char full_tty[200];
/* tmptty shall be bigger than full_tty */ /* tmptty shall be bigger than full_tty */
static char tmptty[sizeof (full_tty)+1]; static char tmptty[sizeof (full_tty)+1];
if ('/' != *tty) { full_tty[0] = '\0';
(void) snprintf (full_tty, sizeof full_tty, "/dev/%s", tty); if (tty[0] != '/')
tty = &full_tty[0]; strcpy (full_tty, "/dev/");
} strncat (full_tty, tty, UT_LINESIZE);
if ('\0' == tmptty[0]) { if ('\0' == tmptty[0]) {
const char *tname = ttyname (STDIN_FILENO); const char *tname = ttyname (STDIN_FILENO);
@ -49,7 +48,7 @@ static bool is_my_tty (const char *tty)
if ('\0' == tmptty[0]) { if ('\0' == tmptty[0]) {
(void) puts (_("Unable to determine your tty name.")); (void) puts (_("Unable to determine your tty name."));
exit (EXIT_FAILURE); exit (EXIT_FAILURE);
} else if (strncmp (tty, tmptty, sizeof (tmptty)) != 0) { } else if (strncmp (full_tty, tmptty, sizeof (tmptty)) != 0) {
return false; return false;
} else { } else {
return true; return true;