Check-in [b83e2d07b5]
Overview
Comment:Added additional bounds checking to conf_apache (needs more)
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: b83e2d07b5ed3053a6a23dfcac92fa17e8e4b9a8
User & Date: rkeene on 2006-12-15 23:33:06
Other Links: manifest | tags
Context
2006-12-16
17:06
Subversion to Fossil Copy Commit. Please Ignore. Recording copying lc_geterrstr.3.in to lc_seterrstr.3.in. check-in: 9f254f7f02 user: rkeene tags: trunk
2006-12-15
23:33
Added additional bounds checking to conf_apache (needs more) check-in: b83e2d07b5 user: rkeene tags: trunk
23:15
Fixed potential buffer bounds issues check-in: e25a9d7fae user: rkeene tags: trunk
Changes

Modified conf_apache.c from [dc1e53e03b] to [963e2cc977].

   135    135   		while (*linebuf_ptr < ' ' && linebuf_ptr >= linebuf) {
   136    136   			*linebuf_ptr = '\0';
   137    137   			linebuf_ptr--;
   138    138   		}
   139    139   
   140    140   		/* Remove leading spaces. */
   141    141   		linebuf_ptr = &linebuf[0];
   142         -		while (*linebuf_ptr == ' ' || *linebuf_ptr == '\t') {
          142  +		while ((*linebuf_ptr == ' ' || *linebuf_ptr == '\t') && linebuf_ptr < (linebuf + sizeof(linebuf))) {
   143    143   			linebuf_ptr++;
   144    144   		}
   145    145   
   146    146   		/* Handle section header. */
   147         -		if (linebuf_ptr[0] == '<' && linebuf_ptr[strlen(linebuf_ptr) - 1] == '>') {
          147  +		if (linebuf_ptr[0] == '<' && linebuf_ptr[strlen(linebuf_ptr) - 1] == '>' && linebuf_ptr < (linebuf + sizeof(linebuf))) {
   148    148   			/* Remove < and > from around the data. */
   149    149   			linebuf_ptr[strlen(linebuf_ptr) - 1] = '\0';
   150    150   			linebuf_ptr++;
   151    151   
   152    152   			/* Lowercase the command part of the section. */
   153    153   			tmp_ptr = linebuf_ptr;
   154         -			while (*tmp_ptr != '\0' && *tmp_ptr != ' ') {
          154  +			while (*tmp_ptr != '\0' && *tmp_ptr != ' ' && tmp_ptr < (linebuf + sizeof(linebuf))) {
   155    155   				*tmp_ptr = tolower(*tmp_ptr);
   156    156   				tmp_ptr++;
   157    157   			}
   158    158   
   159    159   			/* If this is a close section command, handle it */
   160    160   			if (linebuf_ptr[0] == '/') {
   161    161   				linebuf_ptr++;