From: Jo-Philipp Wich <jow@openwrt.org>
Date: Mon, 6 Apr 2009 17:54:55 +0000 (+0000)
Subject: contrib/lar: check for buffer overflows in lar_find_archive() and lar_find_member()
X-Git-Tag: 0.9.0~531
X-Git-Url: https://git.archive.openwrt.org/?p=project%2Fluci.git;a=commitdiff_plain;h=bfa91018ace069edf3deb6c7e0bbe235ed6ecd3f

contrib/lar: check for buffer overflows in lar_find_archive() and lar_find_member()
---

diff --git a/contrib/lar/lar.c b/contrib/lar/lar.c
index 57a16e9ff..ad6cfc8e5 100644
--- a/contrib/lar/lar.c
+++ b/contrib/lar/lar.c
@@ -182,7 +182,12 @@ lar_archive * lar_find_archive( const char *package )
 	LAR_FNAME(buffer);
 
 	for( len = 0; package[len] != '\0'; len++ )
+	{
+		if( len >= sizeof(buffer) )
+			LAR_DIE("Package name exceeds maximum allowed length");
+
 		if( package[len] == '.' ) seg++;
+	}
 
 	while( seg > 0 )
 	{
@@ -213,7 +218,12 @@ lar_member * lar_find_member( lar_archive *ar, const char *package )
 	LAR_FNAME(buffer);
 
 	for( len = 0; package[len] != '\0'; len++ )
+	{
+		if( len >= sizeof(buffer) )
+			LAR_DIE("Package name exceeds maximum allowed length");
+
 		buffer[len] = ( package[len] == '.' ) ? '/' : package[len];
+	}
 
 	buffer[len+0] = '.'; buffer[len+1] = 'l'; buffer[len+2] = 'u';
 	buffer[len+3] = 'a'; buffer[len+4] = '\0';