devs/cproof
1
2
Fork 1
Code Issues 42 Pull Requests 8 Actions Packages Projects 1 Releases Wiki Activity

inp_readline() Correct slashguard feature

Browse Source 
Protect against invalid reads by checking the length.
This commit is contained in:
Michael Vetter
2020-04-21 16:47:18 +02:00
parent f27bd92731
commit 813fd637a1
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/ui/inputwin.c
View File

@@ -197,12 +197,14 @@ inp_readline(void)
if (inp_line) { if (inp_line) {
if (!get_password && prefs_get_boolean(PREF_SLASH_GUARD)) { if (!get_password && prefs_get_boolean(PREF_SLASH_GUARD)) {
if (strlen(inp_line) > 1) {
char *res = (char*) memchr (inp_line+1, '/', 3); char *res = (char*) memchr (inp_line+1, '/', 3);
if (res) { if (res) {
cons_show("Your text contains a slash in the first 4 characters"); cons_show("Your text contains a slash in the first 4 characters");
return NULL; return NULL;
} }
} }
}
return strdup(inp_line); return strdup(inp_line);
} else { } else {
return NULL; return NULL;