[gentoo-commits] gentoo commit in src/patchsets/openmotif/2.2.3: 16_all_mrm_buffer_overflow.patch

[Ulrich Mueller (ulm)]

ulm         10/10/09 14:03:37

  Added:                16_all_mrm_buffer_overflow.patch
  Log:
  Fix buffer overflow in libmrm, bug 340249.

Revision  Changes    Path
1.1                  src/patchsets/openmotif/2.2.3/16_all_mrm_buffer_overflow.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/openmotif/2.2.3/16_all_mrm_buffer_overflow.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/src/patchsets/openmotif/2.2.3/16_all_mrm_buffer_overflow.patch?rev=1.1&content-type=text/plain

Index: 16_all_mrm_buffer_overflow.patch
===================================================================
http://bugs.gentoo.org/340249
Patch backported from openmotif-2.3.3

--- openMotif-2.2.3-orig/lib/Mrm/MrmIheader.c
+++ openMotif-2.2.3/lib/Mrm/MrmIheader.c
@@ -228,9 +228,10 @@
 
   {
     /* sscanf() may call ungetc(), which would write the XmConst string. */
-    char buf[XtNumber(idb__database_version) + 1];
+    char *buf = XtMalloc(strlen(idb__database_version) + 1);
     strcpy(buf, idb__database_version);
     sscanf(buf, "URM %d.%d", &db_major, &db_minor);
+    XtFree(buf);
   }
     
   if ((file_major > db_major) ||