Skip to content

Commit

Permalink
Fix buffer overflow with invalid quotes (#209)
Browse files Browse the repository at this point in the history
A follow-up commit to 6f49ad0.
The quotes can have their upper bits set in which case more than just
two digits are printed, eventually overflowing the allocated memory.

How to reproduce:

less --quotes=$(echo -e '\xff\xff') -f /dev/null
Then enter "-T x" to trigger lglob function
  • Loading branch information
stoeckmann committed Sep 30, 2021
1 parent d0b44fa commit 426fd42
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion filename.c
Original file line number Diff line number Diff line change
Expand Up @@ -757,7 +757,8 @@ lglob(filename)
*/
len = (int) (strlen(lessecho) + strlen(filename) + (7*strlen(metachars())) + 24);
cmd = (char *) ecalloc(len, sizeof(char));
SNPRINTF4(cmd, len, "%s -p0x%x -d0x%x -e%s ", lessecho, openquote, closequote, esc);
SNPRINTF4(cmd, len, "%s -p0x%x -d0x%x -e%s ", lessecho,
(unsigned char) openquote, (unsigned char) closequote, esc);
free(esc);
for (s = metachars(); *s != '\0'; s++)
sprintf(cmd + strlen(cmd), "-n0x%x ", (unsigned char) *s);
Expand Down

0 comments on commit 426fd42

Please sign in to comment.