mined: fix buffer overflow in input()

input() is used to accept filenames when saving, regular
expressions when searching, and other input. It writes
the characters into buffers such as file and exp_buf and
others which are of length LINE_LEN.

To prevent writing beyond the end of the intended buffer,
truncate the input at LINE_LEN - 1 and ensure that the
string is NULL terminated.

Change-Id: I142baa8cfae38bdd7fa648d86559d6d9b8e7a7fd
This commit is contained in:
Thomas Cort 2015-12-22 03:07:01 +00:00 committed by Lionel Sambuc
parent 10b7016b5a
commit ef31660ff2

View File

@ -1694,6 +1694,9 @@ int input(char *inbuf, FLAG clearfl)
}
else
ring_bell();
if (ptr - inbuf >= LINE_LEN - 1)
return FINE;
}
}
quit = FALSE;