pppd: Make sure word read from options file is null-terminated

If a word read from an options file was longer than MAXWORDLEN,
we could pass it to option_error() without null termination,
which could have lead to an out-of-bounds access in vslprintf.
Make sure word[] is null terminated in all cases.

Reported-by: Florian Kohnhäuser <florian@kohnhaeuser.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
This commit is contained in:
Paul Mackerras 2019-12-30 09:32:18 +11:00
parent b311e98b1d
commit c10c3c7cb3

View File

@ -1357,6 +1357,7 @@ getword(f, word, newlinep, filename)
c = getc(f);
}
word[MAXWORDLEN-1] = 0; /* make sure word is null-terminated */
/*
* End of the word: check for errors.