mined: fix buffer overflow in input()
input() is used to accept filenames when saving, regular expressions when searching, and other input. It writes the characters into buffers such as file and exp_buf and others which are of length LINE_LEN. To prevent writing beyond the end of the intended buffer, truncate the input at LINE_LEN - 1 and ensure that the string is NULL terminated. Change-Id: I142baa8cfae38bdd7fa648d86559d6d9b8e7a7fd
This commit is contained in:
parent
10b7016b5a
commit
ef31660ff2
@ -1694,6 +1694,9 @@ int input(char *inbuf, FLAG clearfl)
|
||||
}
|
||||
else
|
||||
ring_bell();
|
||||
|
||||
if (ptr - inbuf >= LINE_LEN - 1)
|
||||
return FINE;
|
||||
}
|
||||
}
|
||||
quit = FALSE;
|
||||
|
Loading…
x
Reference in New Issue
Block a user