Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix heap buffer overflow in selReadStream (detected by clang address sanitizer) #499

Merged
merged 1 commit into from May 6, 2020
Merged

Fix heap buffer overflow in selReadStream (detected by clang address sanitizer) #499

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 1 addition & 5 deletions src/sel1.c
View file
Open in desktop
Expand Up @@ -1414,7 +1414,7 @@ SEL *sel;
SEL *
selReadStream(FILE *fp)
{
char *selname;
char selname[256];
char linebuf[256];
l_int32 sy, sx, cy, cx, i, j, version, ignore;
SEL *sel;
Expand All @@ -1431,17 +1431,14 @@ SEL *sel;

if (fgets(linebuf, sizeof(linebuf), fp) == NULL)
return (SEL *)ERROR_PTR("error reading into linebuf", procName, NULL);
selname = stringNew(linebuf);
DanBloomberg marked this conversation as resolved.
Show resolved Hide resolved
sscanf(linebuf, " ------ %200s ------", selname);
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

... and here 201 bytes were written to selname.


if (fscanf(fp, " sy = %d, sx = %d, cy = %d, cx = %d\n",
&sy, &sx, &cy, &cx) != 4) {
LEPT_FREE(selname);
return (SEL *)ERROR_PTR("dimensions not read", procName, NULL);
}

if ((sel = selCreate(sy, sx, selname)) == NULL) {
LEPT_FREE(selname);
return (SEL *)ERROR_PTR("sel not made", procName, NULL);
}
selSetOrigin(sel, cy, cx);
Expand All @@ -1454,7 +1451,6 @@ SEL *sel;
}
ignore = fscanf(fp, "\n");

LEPT_FREE(selname);
return sel;
}

Expand Down