From: Sami Kerola <kerolasa@iki.fi>
Date: Sat, 2 Apr 2011 20:56:50 +0000 (+0200)
Subject: setterm: segfault with long dump file name
X-Git-Tag: v2.20-rc1~385
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2971543625817182ec009f97f93a2157c6c09fed;p=thirdparty%2Futil-linux.git

setterm: segfault with long dump file name

The patch will make too long path to be truncated to MAX_PATH
lenght. If user supplies too long file name that is caught at
fopen. Some users might find this unintuitive, so the altered
behavior will be mantioned in manual page.

Bug in earlier version was visible with a command bellow.

setterm -dump -file $(for i in $(seq 254); do printf x ; done)

Signed-off-by: Sami Kerola <kerolasa@iki.fi>
---

diff --git a/term-utils/setterm.c b/term-utils/setterm.c
index 14b2c3df47..1ced695791 100644
--- a/term-utils/setterm.c
+++ b/term-utils/setterm.c
@@ -202,7 +202,7 @@ int opt_tb_array[161];		/* Array for tab list */
 int opt_msglevel_num;
 int opt_ps_mode, opt_pd_min;	/* powersave mode/powerdown time */
 
-char opt_sn_name[200] = "screen.dump";
+char opt_sn_name[PATH_MAX + 1] = "screen.dump";
 
 static void screendump(int vcnum, FILE *F);
 
@@ -525,8 +525,9 @@ parse_snapfile(int argc, char **argv, int *option, int *opt_all, int *bad_arg) {
 	if (argc != 1 || *option)
 		*bad_arg = TRUE;
 	*option = TRUE;
+	memset(opt_all, 0, PATH_MAX + 1);
 	if (argc == 1)
-		strcpy((char *)opt_all, argv[0]);
+		strncpy((char *)opt_all, argv[0], PATH_MAX);
 }
 
 static void