File: buffer-overflows.dpatch

package info (click to toggle)
xvt 2.1-14
  • links: PTS
  • area: main
  • in suites: woody
  • size: 348 kB
  • ctags: 430
  • sloc: ansic: 5,107; perl: 1,329; makefile: 31; sh: 29
file content (50 lines) | stat: -rw-r--r-- 1,785 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
diff -ur ../xvt-2.1-old/xsetup.c ./xsetup.c
--- ../xvt-2.1-old/xsetup.c	Wed Sep 17 17:23:17 1997
+++ ./xsetup.c	Wed Jun 27 16:55:05 2001
@@ -303,7 +306,7 @@
 			com_env[j++] = environ[i];
 	}
 	com_env[j++] = scopy(TERM_ENV);
-	sprintf(buf,"DISPLAY=%s",DisplayString(display));
+	sprintf(buf,"DISPLAY=%.400s",DisplayString(display));
 	com_env[j++] = scopy(buf);
 	sprintf(buf,"WINDOWID=%d",(int)main_win);
 	com_env[j++] = scopy(buf);
@@ -391,8 +394,8 @@
 
 	/*  See if there was a display named in the command line
 	 */
-	sprintf(str1,"%s.display",res_name);
-	sprintf(str2,"%s.Display",XVT_CLASS);
+	sprintf(str1,"%.100s.display",res_name);
+	sprintf(str2,"%.100s.Display",XVT_CLASS);
 	if (XrmGetResource(commandlineDB,str1,str2,&str_type,&value) == True) {
 		strncpy(str1,value.addr,(int)value.size);
 		display_name = str1;
@@ -529,18 +535,22 @@
 	XrmValue value;
 	char *str_type;
 
-	sprintf((char *)str1,"%s.%s",res_name,name);
-	sprintf((char *)str2,"%s.%s",XVT_CLASS,class);
+	sprintf((char *)str1,"%.100s.%.100s",res_name,name);
+	sprintf((char *)str2,"%.100s.%.100s",XVT_CLASS,class);
 	if (XrmGetResource(rDB,str1,str2,&str_type,&value) == True) {
+		if (value.size > 255)
+			value.size = 255;
 		strncpy((char *)resource,value.addr,(int)value.size);
 		return(resource);
 	}
 
 	/*  The following is added for compatibility with xterm.
 	 */
-	sprintf((char *)str1,"%s.vt100.%s",res_name,name);
-	sprintf((char *)str2,"%s.VT100.%s",XVT_CLASS,class);
+	sprintf((char *)str1,"%.100s.vt100.%.100s",res_name,name);
+	sprintf((char *)str2,"%.100s.VT100.%.100s",XVT_CLASS,class);
 	if (XrmGetResource(rDB,str1,str2,&str_type,&value) == True) {
+		if (value.size > 255)
+			value.size = 255;
 		strncpy((char *)resource,value.addr,(int)value.size);
 		return(resource);
 	}