empire/empserver
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

empdump failed to catch some invalid column names

Browse source 
It missed those with more flags than just NSC_EXTRA set: table sect
name uid, table nat names passwd, xorg, yorg, contacts, rejects.
Since xundump() doesn't provide space for these, the bug could lead to
buffer overruns.  Fixes flawed commit 726a8e3d, v4.3.12.
This commit is contained in:
Markus Armbruster 2011-05-08 12:12:09 +02:00
parent 7e95b52bce
commit b40741dc5f
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/lib/common/xundump.c
View file

@ -352,7 +352,7 @@ deffld(int fldno, char *name, int idx)
if (res < 0) if (res < 0)
return gripe("Header %s of field %d is %s", name, fldno + 1, return gripe("Header %s of field %d is %s", name, fldno + 1,
res == M_NOTUNIQUE ? "ambiguous" : "unknown"); res == M_NOTUNIQUE ? "ambiguous" : "unknown");
if (ca[res].ca_flags == NSC_EXTRA || CANT_HAPPEN(ca[res].ca_get)) if ((ca[res].ca_flags & NSC_EXTRA) || CANT_HAPPEN(ca[res].ca_get))
return gripe("Extraneous header %s in field %d", name, fldno + 1); return gripe("Extraneous header %s in field %d", name, fldno + 1);
if (ca[res].ca_type != NSC_STRINGY && ca[res].ca_len != 0) { if (ca[res].ca_type != NSC_STRINGY && ca[res].ca_len != 0) {
if (idx < 0) if (idx < 0)