Commit Graph

6 Commits

Author SHA1 Message Date
PatR
cdc598e8bd fix pline.c potential buffer overruns
Fix 'Bugs 4, 5, and 6' which all use a similar fix but would have
conflicts over '#define BIGBUFSZ' if committed separately.

Format ("short explanation %s", string_argument), where the
explanation always has modest length but the string is potentially
up to 4*BUFSZ in length, into a 5*BUFSZ buffer.  Then truncate the
result to at most BUFSZ-1 characters so that it can be safely passed
to interface-specific putstr() or raw_print().

Applies to pline(), raw_printf(), and config_error_add().  Also done
for impossible() although there's no evidence that its buffer could
be overflowed in a controlled manner.
2020-01-14 02:52:34 -08:00
PatR
74de7d31e0 fix sym_val() buffer overrun
Fix 'Bug 3' where too long SYMBOL=string in run-time config file could
overflow a local buffer and clobber the stack.

Valid value is only one character long after processing an 'escaped'
encoded character which can be at most 6 characters (plus terminator):
backslash M backslash and up three digits.  If/when UTF8 gets added
the number of digits will increase.  Use a truncated copy of the input
(substantially bigger than 6+1); ignore any excess.
2020-01-14 02:05:14 -08:00
PatR
a842fda44c fix add_menu_coloring() buffer overrun
Fix 'Bug 2' where too long MENUCOLOR=string in run-time config file
could overflow a local buffer and clobber the stack.

Theoretically a menu coloring regular expression could require a
bigger buffer but I don't think we need to try to support that.
255 characters minus the amount needed to specify color and/or
attributes should be ample.
2020-01-13 19:26:53 -08:00
PatR
c35139e9ce fixes36.5 2020-01-13 19:17:35 -08:00
nhmall
25c9fb8d2f fixes update 2020-01-13 15:30:23 -05:00
nhmall
843bb5cfc9 landing spot for post-3.6.4 patches if needed
This is a landing spot.
2019-12-18 16:49:55 -05:00