Skip to content

Commit

Permalink
Fix stack buffer overflow (#233)
Browse files Browse the repository at this point in the history
The adjustment of parse_error introduced a possible stack buffer
overflow if lesskey filename is long enough.

How to reproduce:

KEYFILE=$(python -c 'print("/tmp/"+4*(255*"a"+"/")+"lesskey.txt")')
install -d $(dirname KEYFILE)
echo "#version a" > $KEYFILE
less --lesskey-src=$KEYFILE -f /dev/null
  • Loading branch information
stoeckmann committed Dec 20, 2021
1 parent f90a807 commit ae087e2
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion lesskey_parse.c
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,8 @@ parse_error(fmt, arg1)
{
char buf[1024];
int n = snprintf(buf, sizeof(buf), "%s: line %d: ", lesskey_file, linenum);
snprintf(buf+n, sizeof(buf)-n, fmt, arg1);
if (n >= 0 && n < sizeof(buf))
snprintf(buf+n, sizeof(buf)-n, fmt, arg1);
++errors;
lesskey_parse_error(buf);
}
Expand Down

0 comments on commit ae087e2

Please sign in to comment.