d0p1/ack
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Non existing token fields in the format string caused memfaults

Browse source 
because fields were checked beyond the end of the tokeninfo. Fixed.
This commit is contained in:
sater 1986-05-21 15:08:57 +00:00
parent a4887558b8
commit 5a84f07281
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
util/ncgg/subr.c
View file

@ -90,6 +90,7 @@ struct varinfo *atts,*cost,*format;
register struct varinfo *vip; register struct varinfo *vip;
int i; int i;
int tokno; int tokno;
int thistokensize;
char formstr[50],smallstr[2]; char formstr[50],smallstr[2];
sy_p = lookup(name,symtok,newsymbol); sy_p = lookup(name,symtok,newsymbol);
@ -111,6 +112,7 @@ struct varinfo *atts,*cost,*format;
tp->tk_att[i].ta_name = vip->vi_str[0]; tp->tk_att[i].ta_name = vip->vi_str[0];
vip->vi_str[0]=0; vip->vi_str[0]=0;
} }
thistokensize=i;
if (i>maxtokensize) if (i>maxtokensize)
maxtokensize=i; maxtokensize=i;
if (vip!=0) if (vip!=0)
@ -123,7 +125,7 @@ struct varinfo *atts,*cost,*format;
if (vip->vi_int[0]==0) if (vip->vi_int[0]==0)
strcat(formstr,vip->vi_str[0]); strcat(formstr,vip->vi_str[0]);
else { else {
for(i=0;i<MAXATT;i++) { for(i=0;i<thistokensize;i++) {
if (strcmp(vip->vi_str[0],tp->tk_att[i].ta_name)==0) { if (strcmp(vip->vi_str[0],tp->tk_att[i].ta_name)==0) {
smallstr[0] = i+1; smallstr[0] = i+1;
smallstr[1] = 0; smallstr[1] = 0;
@ -131,7 +133,7 @@ struct varinfo *atts,*cost,*format;
break; break;
} }
} }
if (i==MAXATT) if (i==thistokensize)
error("%s not a known attribute", error("%s not a known attribute",
vip->vi_str[0]); vip->vi_str[0]);
} }