[Sec 2630] buffer overrun in ntpq tokenize()

bk: 5465c90dVRkNdoFoI_Qy5njl2AgDTg

diff --git a/ChangeLog b/ChangeLog
index 26aa3f5175fbcf524c9dfcdcfc2392169b105a45..766a365fa7e8f552ec956231e4f78eb1daaf4ff1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,4 @@
+* [Sec 2630] buffer overrun in ntpq tokenize().
 * [Bug 2661] ntpq crashes with mreadvar.
 (4.2.7p477) 2014/11/13 Released by Harlan Stenn <stenn@ntp.org>
 * [Bug 2657] Document that "restrict nopeer" intereferes with "pool".

diff --git a/ntpq/ntpq.c b/ntpq/ntpq.c
index 33cdd44427d3a31f402eb91d5be371362dfb469b..2ffdfc7be0ec13fdc878ad96e25d1d38c2e5a38a 100644 (file)
--- a/ntpq/ntpq.c
+++ b/ntpq/ntpq.c
@@ -1575,6 +1575,8 @@ tokenize(
 
                if (*ntok == 1 && tokens[0][0] == ':') {
                        do {
+                               if (sp - tspace >= MAXLINE)
+                                       goto toobig;
                                *sp++ = *cp++;
                        } while (!ISEOL(*cp));
                }
@@ -1585,19 +1587,33 @@ tokenize(
                else if (*cp == '\"') {
                        ++cp;
                        do {
+                               if (sp - tspace >= MAXLINE)
+                                       goto toobig;
                                *sp++ = *cp++;
                        } while ((*cp != '\"') && !ISEOL(*cp));
                        /* HMS: a missing closing " should be an error */
                }
                else {
                        do {
+                               if (sp - tspace >= MAXLINE)
+                                       goto toobig;
                                *sp++ = *cp++;
                        } while ((*cp != '\"') && !ISSPACE(*cp) && !ISEOL(*cp));
                        /* HMS: Why check for a " in the previous line? */
                }
 
+               if (sp - tspace >= MAXLINE)
+                       goto toobig;
                *sp++ = '\0';
        }
+       return;
+
+  toobig:
+       *ntok = 0;
+       fprintf(stderr,
+               "***Line `%s' is too big\n",
+               line);
+       return;
 }