Commit 2503ec36 authored by Qualys Security Advisory's avatar Qualys Security Advisory Committed by Craig Small

w: Clamp maxcmd to the MIN/MAX_CMD_WIDTH range.

The current checks allow out-of-range values (for example, if
getenv/atoi returns ~-2GB, maxcmd becomes ~+2GB after the subtraction).
This is not a security problem, none of this is under an attacker's
control.
parent 3a437012
......@@ -579,11 +579,14 @@ int main(int argc, char **argv)
maxcmd = atoi(p);
else
maxcmd = MAX_CMD_WIDTH;
if (MAX_CMD_WIDTH < maxcmd)
maxcmd = MAX_CMD_WIDTH;
#define CLAMP_CMD_WIDTH(cw) do { \
if ((cw) < MIN_CMD_WIDTH) (cw) = MIN_CMD_WIDTH; \
if ((cw) > MAX_CMD_WIDTH) (cw) = MAX_CMD_WIDTH; \
} while (0)
CLAMP_CMD_WIDTH(maxcmd);
maxcmd -= 21 + userlen + (from ? fromlen : 0) + (longform ? 20 : 0);
if (maxcmd < MIN_CMD_WIDTH)
maxcmd = MIN_CMD_WIDTH;
CLAMP_CMD_WIDTH(maxcmd);
#undef CLAMP_CMD_WIDTH
procs = readproctab(PROC_FILLCOM | PROC_FILLUSR | PROC_FILLSTAT);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment