[Bug 2937] (NTPQ) nextvar() missing length check

bk: 561a1098bV4TuIdC-bG8ms5EzF3FIQ

diff --git a/ChangeLog b/ChangeLog
index b022ef6f6a86c267d69a5ae3c8fa64474ef83859..839efbfcac685a726c1b0d733a5a17fe03e5b778 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,6 @@
 ---
+* [Bug 2937] ntpq: nextvar() missing length check. perlinger@ntp.org
+---
 (4.2.8p4-RC1) 2015/10/06 Released by Harlan Stenn <stenn@ntp.org>
 
 * [Bug 2332] (reopened) Exercise thread cancellation once before dropping

diff --git a/ntpq/ntpq.c b/ntpq/ntpq.c
index 17fe2ea45d5b756b48e85e4833211cf7158af6dd..ce3a49b4584e6971e5106287c8edccb938810967 100644 (file)
--- a/ntpq/ntpq.c
+++ b/ntpq/ntpq.c
@@ -2950,6 +2950,8 @@ nextvar(
        len = srclen;
        while (len > 0 && isspace((unsigned char)cp[len - 1]))
                len--;
+       if (len >= sizeof(name))
+           return 0;
        if (len > 0)
                memcpy(name, cp, len);
        name[len] = '\0';