fbt/sbase
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

od: Don't advance past end of type string

Browse Source 
Currently, if you specify -t x, then s is advanced once in the switch statement
to determine the length, and then once again in the for loop, resulting in a
read past the end of the argument.

Also, use sizeof(int) when no length is specified, as specified by POSIX.
This commit is contained in:
Michael Forney 2016-07-08 10:24:08 -07:00 committed by sin
parent 5ae2793da6
commit 49e1854600
1 changed files with 9 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
od.c
View File

@ -196,7 +196,7 @@ main(int argc, char *argv[])
{
FILE *fp;
struct type *t;
int ret = 0;
int ret = 0, len;
char *s;
big_endian = (*(uint16_t *)"\0\xff" == 0xff);
@ -244,30 +244,28 @@ main(int argc, char *argv[])
case 'o':
case 'u':
case 'x':
t = emalloc(sizeof(*t));
t->format = *s;
/* todo: allow multiple digits */
if (*(s+1) > '0' && *(s+1) <= '9') {
t->len = *(++s) - '0';
len = *(s+1) - '0';
} else {
switch (*(++s)) {
switch (*(s+1)) {
case 'C':
t->len = sizeof(char);
len = sizeof(char);
break;
case 'S':
t->len = sizeof(short);
len = sizeof(short);
break;
case 'I':
t->len = sizeof(int);
len = sizeof(int);
break;
case 'L':
t->len = sizeof(long);
len = sizeof(long);
break;
default:
t->len = 4;
len = sizeof(int);
}
}
TAILQ_INSERT_TAIL(&head, t, entry);
addtype(*s++, len);
break;
default:
usage();