fix pline.c potential buffer overruns

Fix 'Bugs 4, 5, and 6' which all use a similar fix but would have
conflicts over '#define BIGBUFSZ' if committed separately.

Format ("short explanation %s", string_argument), where the
explanation always has modest length but the string is potentially
up to 4*BUFSZ in length, into a 5*BUFSZ buffer.  Then truncate the
result to at most BUFSZ-1 characters so that it can be safely passed
to interface-specific putstr() or raw_print().

Applies to pline(), raw_printf(), and config_error_add().  Also done
for impossible() although there's no evidence that its buffer could
be overflowed in a controlled manner.
This commit is contained in:
PatR
2020-01-14 02:52:34 -08:00
parent 74de7d31e0
commit cdc598e8bd
2 changed files with 10 additions and 6 deletions

View File

@@ -10,6 +10,7 @@ have string_for_opt() return empty_optstr on failure
ensure existing callers of string_for_opt() check return value before using it
fix potential buffer overflow in add_menu_coloring()
fix potential buffer overflow in sym_val()
fix potential buffer overflow in pline(), raw_printf(), and config_error_add()
Fixes to Post-3.6.4 Problems that Were Exposed Via git Repository