diff options
author | 2010-10-09 14:03:24 +0000 | |
---|---|---|
committer | 2010-10-09 14:03:24 +0000 | |
commit | dcbcdda29e9ec2ff17bd5dab69f10e92af0fe72b (patch) | |
tree | bd0bb15327a5bc4b744bb784fe068dfaa40e3631 | |
parent | Fix typo. (diff) | |
download | ulm-dcbcdda29e9ec2ff17bd5dab69f10e92af0fe72b.tar.gz ulm-dcbcdda29e9ec2ff17bd5dab69f10e92af0fe72b.tar.bz2 ulm-dcbcdda29e9ec2ff17bd5dab69f10e92af0fe72b.zip |
Fix buffer overflow in libmrm, bug 340249.openmotif-2.2.3-patches-4
-rw-r--r-- | patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch b/patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch new file mode 100644 index 0000000..d4080df --- /dev/null +++ b/patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch @@ -0,0 +1,17 @@ +http://bugs.gentoo.org/340249 +Patch backported from openmotif-2.3.3 + +--- openMotif-2.2.3-orig/lib/Mrm/MrmIheader.c ++++ openMotif-2.2.3/lib/Mrm/MrmIheader.c +@@ -228,9 +228,10 @@ + + { + /* sscanf() may call ungetc(), which would write the XmConst string. */ +- char buf[XtNumber(idb__database_version) + 1]; ++ char *buf = XtMalloc(strlen(idb__database_version) + 1); + strcpy(buf, idb__database_version); + sscanf(buf, "URM %d.%d", &db_major, &db_minor); ++ XtFree(buf); + } + + if ((file_major > db_major) || |