Attachment 695972 Details for Bug 909325 – Patch for OVERRUN-CWE-119 bug

[patch] Patch for OVERRUN-CWE-119 bug

0001-OVERRUN-CWE-119.patch (text/plain), 3.73 KB, created by Tomáš Hozza on 2013-02-11 07:25:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomáš Hozza

Created: 2013-02-11 07:25:18 UTC

Size: 3.73 KB

patch

obsolete

>From 88971a0a5660805f71ba8696e9291eaee822d996 Mon Sep 17 00:00:00 2001
>From: Tomas Hozza <thozza@redhat.com>
>Date: Fri, 8 Feb 2013 15:12:32 +0100
>Subject: [PATCH 1/4] OVERRUN (CWE-119)
>
>Coverity output:
>bsd-finger-0.17/finger/util.c:392: cond_true: Condition "*q", taking
>true branch
>bsd-finger-0.17/finger/util.c:393: cond_false: Condition
>"!(*__ctype_b_loc()[(int)*q] & 2048 /* (unsigned short)_ISdigit */)",
>taking false branch
>bsd-finger-0.17/finger/util.c:394: if_end: End of if statement
>bsd-finger-0.17/finger/util.c:394: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/util.c:392: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/util.c:392: cond_false: Condition "*q", taking
>false branch
>bsd-finger-0.17/finger/util.c:394: loop_end: Reached end of loop
>bsd-finger-0.17/finger/util.c:396: alias: Assigning: "p" = "pbuf". "p"
>now points to byte 0 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:397: switch: Switch case value "11"
>bsd-finger-0.17/finger/util.c:398: switch_case: Reached case "11"
>bsd-finger-0.17/finger/util.c:399: ptr_incr: Incrementing "p". "p" now
>points to byte 1 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:400: ptr_incr: Incrementing "p". "p" now
>points to byte 2 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:401: ptr_incr: Incrementing "p". "p" now
>points to byte 3 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:404: ptr_incr: Incrementing "p". "p" now
>points to byte 4 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:405: ptr_incr: Incrementing "p". "p" now
>points to byte 5 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:406: ptr_incr: Incrementing "p". "p" now
>points to byte 6 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:407: ptr_incr: Incrementing "p". "p" now
>points to byte 7 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:410: ptr_incr: Incrementing "p". "p" now
>points to byte 8 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:411: ptr_incr: Incrementing "p". "p" now
>points to byte 9 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:412: ptr_incr: Incrementing "p". "p" now
>points to byte 10 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:413: break: Breaking from switch
>bsd-finger-0.17/finger/util.c:421: switch_end: Reached end of switch
>bsd-finger-0.17/finger/util.c:422: cond_true: Condition "len != 4",
>taking true branch
>bsd-finger-0.17/finger/util.c:423: ptr_incr: Incrementing "p". "p" now
>points to byte 11 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:424: ptr_incr: Incrementing "p". "p" now
>points to byte 12 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:426: ptr_incr: Incrementing "p". "p" now
>points to byte 13 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:427: ptr_incr: Incrementing "p". "p" now
>points to byte 14 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:428: ptr_incr: Incrementing "p". "p" now
>points to byte 15 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:429: overrun-local: Overrunning array of
>15 bytes at byte offset 15 by dereferencing pointer "p".
>
>Signed-off-by: Tomas Hozza <thozza@redhat.com>
>---
> finger/util.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/finger/util.c b/finger/util.c
>index a9c3b5d..ee44541 100644
>--- a/finger/util.c
>+++ b/finger/util.c
>@@ -386,7 +386,7 @@ prphone(const char *num)
> 	char *p;
> 	const char *q;
> 	int len;
>-	static char pbuf[15];
>+	static char pbuf[16];
> 
> 	/* don't touch anything if the user has their own formatting */
> 	for (q = num; *q; ++q)
>-- 
>1.8.1.2
>

Actions: View | Diff

Attachments on bug 909325: 695130 | 695972 | 695973 | 695974 | 695975