nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

command line triggered buffer overruns

Browse Source 
Prevent extremely long command line arguments from overflowing local
buffers in raw_printf or config_error_add.  The increased buffer
sizes they recently got to deal with long configuration file values
aren't sufficient to handle command line induced overflows.

choose_windows(core): copy and truncate the window_type argument in
case it gets passed to config_error_add().

process_options(unix): report bad values with "%.60s" so that vsprintf
will implicitly truncate when formatted by raw_printf().
This commit is contained in:
PatR
2020-01-16 05:22:18 -08:00
committed by nhmall
parent a8208b44c8
commit f3def5c0b9
4 changed files with 25 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sys/unix/unixmain.c
View File

@@ -355,6 +355,7 @@ char *argv[];
return 0;
}
/* caveat: argv elements might be arbitrary long */
static void
process_options(argc, argv)
int argc;
@@ -383,11 +384,10 @@ char *argv[];
load_symset("DECGraphics", PRIMARY);
switch_symbols(TRUE);
} else {
raw_printf("Unknown option: %s", *argv);
raw_printf("Unknown option: %.60s", *argv);
}
break;
case 'X':
discover = TRUE, wizard = FALSE;
break;
#ifdef NEWS
@@ -413,7 +413,7 @@ char *argv[];
load_symset("RogueIBM", ROGUESET);
switch_symbols(TRUE);
} else {
raw_printf("Unknown option: %s", *argv);
raw_printf("Unknown option: %.60s", *argv);
}
break;
case 'p': /* profession (role) */
@@ -451,7 +451,7 @@ char *argv[];
flags.initrole = i;
break;
}
/* else raw_printf("Unknown option: %s", *argv); */
/* else raw_printf("Unknown option: %.60s", *argv); */
}
}