Web   ·   Wiki   ·   Activities   ·   Blog   ·   Lists   ·   Chat   ·   Meeting   ·   Bugs   ·   Git   ·   Translate   ·   Archive   ·   People   ·   Donate
summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--ChangeLog6
-rw-r--r--ps/ps.c6
2 files changed, 10 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index 40a7006..fdfb9e1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2006-11-30 Carlos Garcia Campos <carlosgc@gnome.org>
+
+ * ps/ps.c: (get_next_text):
+
+ Fix CVE-2006-5864.
+
2006-11-22 Carlos Garcia Campos <carlosgc@gnome.org>
* shell/ev-history.c: (ev_history_finalize), (ev_history_class_init):
diff --git a/ps/ps.c b/ps/ps.c
index 30b9e56..b4b54e0 100644
--- a/ps/ps.c
+++ b/ps/ps.c
@@ -1231,7 +1231,8 @@ get_next_text(line, next_char)
int level = 0;
quoted = 1;
line++;
- while(*line && !(*line == ')' && level == 0)) {
+ while(*line && !(*line == ')' && level == 0)
+ && (cp - text) < PSLINELENGTH - 1) {
if(*line == '\\') {
if(*(line + 1) == 'n') {
*cp++ = '\n';
@@ -1302,7 +1303,8 @@ get_next_text(line, next_char)
}
}
else {
- while(*line && !(*line == ' ' || *line == '\t' || *line == '\n'))
+ while(*line && !(*line == ' ' || *line == '\t' || *line == '\n')
+ && (cp - text) < PSLINELENGTH - 1)
*cp++ = *line++;
}
*cp = '\0';