Shishir Jaiswal 957aefdc8f Bug#23498283 - BUFFER OVERFLOW ...

DESCRIPTION
===========
Buffer overflow is reported in Regex library. This can be
triggered when the data corresponding to argv[1] is >=
512 bytes resutling in abnormal behaviour.

ANALYSIS
========
Its a straight forward case of SEGFAULT where the target
buffer is smaller than the source string to be copied.
A simple pre-copy validation should do.

FIX
===
A check is added before doing strcpy() to ensure that the
target buffer is big enough to hold the to-be copied data.
If the check fails, the program aborts.

2016-06-17 10:11:33 +05:30

7.2 KiB

Raw Blame History

View Raw