|
From: Cyril H. <su...@li...> - 2013-03-22 03:21:55
|
The branch, master, has been updated
via f56e615d4b0b931a104c3daa0f4ed62a2c6a3e2c (commit)
from 575f9932699347440201d5ca6814cbe16cf35ac5 (commit)
- Log -----------------------------------------------------------------
commit f56e615d4b0b931a104c3daa0f4ed62a2c6a3e2c
Author: Jan Stancek <jst...@re...>
Date: Thu Mar 21 16:08:26 2013 +0100
pan: fix potential overrun in tag_report
char *cuts_info[5];
...
while (tok_num < 5 &&
(cuts_info[++tok_num] = strtok(NULL, "\t ")) != NULL) ;
While above can run for tok_num == 4, in which case:
cuts_info[++tok_num] becomes cuts_info[5]
and that is outside of cuts_info array.
Signed-off-by: Jan Stancek <jst...@re...>
Signed-off-by: Wanlong Gao <gao...@cn...>
-----------------------------------------------------------------------
Summary of changes:
pan/tag_report.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/pan/tag_report.c b/pan/tag_report.c
index 473bed1..61caabd 100644
--- a/pan/tag_report.c
+++ b/pan/tag_report.c
@@ -425,7 +425,7 @@ SYM tags;
int cuts_testcase(tag, keys)
SYM tag, keys;
{
- char *cuts_info[5];
+ char *cuts_info[6];
char key[KEYSIZE];
char *oldresult, *newresult, *worst_case();
int tok_num = 0;
hooks/post-receive
--
ltp
|