From 1dc67acd408a050178a96c0e568ea221d384a7eb Mon Sep 17 00:00:00 2001 From: Joachim Nilsson Date: Mon, 5 Dec 2016 08:37:41 +0100 Subject: [PATCH] chargen: Make sure to check target buffer size Signed-off-by: Joachim Nilsson --- plugins/chargen.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/plugins/chargen.c b/plugins/chargen.c index 97e463da..bea15a02 100644 --- a/plugins/chargen.c +++ b/plugins/chargen.c @@ -30,25 +30,32 @@ #define NAME "chargen" #define PATTERN "!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~ " -static char *generator(char *buf, size_t len) +static char *generator(char *buf, size_t buflen) { - size_t num; + size_t num, len, width = 72; static size_t pos = 0; const char pattern[] = PATTERN; - len = 72; + if (buflen < width) + width = buflen; + + len = width; + if (len + 3 > buflen) + len = buflen - 3; if (pos + len > sizeof(pattern)) { num = sizeof(pattern) - pos; len -= num; } else { - num = 72; + num = width; + if (num + 3 > buflen) + num = buflen - 3; len = 0; } - strncpy(&buf[0], &pattern[pos], num--); + strncpy(buf, &pattern[pos], num--); if (len++) strncpy(&buf[num], pattern, len); - strcat(buf, "\r\n"); + strlcat(buf, "\r\n", width); if (++pos >= sizeof(pattern) - 1) pos = 0;