emo/procps
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

ps/sortformat.c: Catch negative width in format_parse().

Browse Source 
The existing strspn() check guarantees that the string contains no '-'
but atoi() does not catch errors, especially not integer overflows.
This commit is contained in:
Qualys Security Advisory 1970-01-01 00:00:00 +00:00 committed by Craig Small
parent db00f54f4a
commit cde22815af
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ps/sortformat.c
View File

@ -271,7 +271,7 @@ static const char *format_parse(sf_node *sfn){
if(colon_loc){ /* if width override */ if(colon_loc){ /* if width override */
*colon_loc = '\0'; *colon_loc = '\0';
colon_loc++; colon_loc++;
if(strspn(colon_loc,"0123456789") != strlen(colon_loc) || *colon_loc=='0' || !*colon_loc){ if(strspn(colon_loc,"0123456789") != strlen(colon_loc) || *colon_loc=='0' || !*colon_loc || atoi(colon_loc) <= 0){
free(buf); free(buf);
goto badwidth; goto badwidth;
} }
@ -296,6 +296,7 @@ static const char *format_parse(sf_node *sfn){
} }
// FIXME: enforce signal width to 8, 9, or 16 (grep: SIGNAL wide_signals) // FIXME: enforce signal width to 8, 9, or 16 (grep: SIGNAL wide_signals)
fnode->width = atoi(colon_loc); // already verified to be a number fnode->width = atoi(colon_loc); // already verified to be a number
if(fnode->width <= 0) catastrophic_failure(__FILE__, __LINE__, _("please report this bug"));
} }
endp = fnode; while(endp->next) endp = endp->next; /* find end */ endp = fnode; while(endp->next) endp = endp->next; /* find end */
endp->next = sfn->f_cooked; endp->next = sfn->f_cooked;