forked from pool/cracklib
Marcus Meissner
d3c3dc0115
- Add patch 0004-overflow-processing-long-words.patch to fix a new buffer overflow identified together with bsc#992966. - Relabel patches: cracklib-magic.diff -> 0001-cracklib-magic.diff cracklib-2.9.2-visibility.patch -> 0002-cracklib-2.9.2-visibility.patch - Add patch 0003-overflow-processing-gecos.patch to fix a buffer overflow in GECOS parser (bsc#992966 CVE-2016-6318) OBS-URL: https://build.opensuse.org/request/show/419768 OBS-URL: https://build.opensuse.org/package/show/Base:System/cracklib?expand=0&rev=44
22 lines
758 B
Diff
22 lines
758 B
Diff
The input word is guaranteed to be at most STRINGSIZE-1 in length. One of the
|
|
mangle operations involves duplicating the input word, resulting in a string
|
|
twice the length to be accommodated by both area variables.
|
|
|
|
Howard Guo <hguo@suse.com> 2016-08-17
|
|
|
|
diff -rupN 3/lib/rules.c 3-patched/lib/rules.c
|
|
--- 3/lib/rules.c 2016-08-16 14:16:24.033261876 +0200
|
|
+++ 3-patched/lib/rules.c 2016-08-17 13:57:14.485782894 +0200
|
|
@@ -434,9 +434,8 @@ Mangle(input, control) /* returns a poi
|
|
{
|
|
int limit;
|
|
register char *ptr;
|
|
- static char area[STRINGSIZE];
|
|
- char area2[STRINGSIZE];
|
|
- area[0] = '\0';
|
|
+ static char area[STRINGSIZE * 2] = {0};
|
|
+ char area2[STRINGSIZE * 2] = {0};
|
|
strcpy(area, input);
|
|
|
|
for (ptr = control; *ptr; ptr++)
|