Skip to content

Commit

Permalink
Use a dynamically-allocated line buffer and resize as needed.
Browse files Browse the repository at this point in the history
Fixes a buffer overflow for lines over 2048 bytes.
Problem reported by Crystal Kolipe.  OK deraadt@
  • Loading branch information
millert committed Sep 27, 2023
1 parent 127a57c commit 08e9b19
Showing 1 changed file with 16 additions and 3 deletions.
19 changes: 16 additions & 3 deletions usr.bin/deroff/deroff.c
@@ -1,4 +1,4 @@
/* $OpenBSD: deroff.c,v 1.17 2023/03/08 04:43:10 guenther Exp $ */
/* $OpenBSD: deroff.c,v 1.18 2023/09/27 21:06:33 millert Exp $ */

/*-
* Copyright (c) 1988, 1993
Expand Down Expand Up @@ -135,7 +135,8 @@ int keepblock; /* keep blocks of text; normally false when msflag */

char chars[128]; /* SPECIAL, PUNCT, APOS, DIGIT, or LETTER */

char line[LINE_MAX];
size_t linesz;
char *line;
char *lp;

int c;
Expand Down Expand Up @@ -342,6 +343,10 @@ main(int ac, char **av)
files[0] = infile;
filesp = &files[0];

linesz = LINE_MAX;
if ((line = malloc(linesz)) == NULL)
err(1, NULL);

for (i = 'a'; i <= 'z'; ++i)
chars[i] = LETTER;
for (i = 'A'; i <= 'Z'; ++i)
Expand Down Expand Up @@ -477,7 +482,15 @@ regline(void (*pfunc)(char *, int), int constant)

line[0] = c;
lp = line;
while (lp - line < sizeof(line)) {
for (;;) {
if (lp - line == linesz - 1) {
char *newline = reallocarray(line, linesz, 2);
if (newline == NULL)
err(1, NULL);
lp = newline + (lp - line);
line = newline;
linesz *= 2;
}
if (c == '\\') {
*lp = ' ';
backsl();
Expand Down

0 comments on commit 08e9b19

Please sign in to comment.