Re: [Nagios-devel] [PATCH] fix out of bounds access
Posted: Sun Oct 08, 2006 9:20 pm
Olaf Hering wrote:
> Do not write outside the hostname array.
> snprintf will likely terminate the string anyway.
>
> ---
> cgi/notifications.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> Index: nagios-2.5/cgi/notifications.c
> ===================================================================
> --- nagios-2.5.orig/cgi/notifications.c
> +++ nagios-2.5/cgi/notifications.c
> @@ -553,7 +553,7 @@ void display_notifications(void){
> /* get the host name */
> temp_buffer=(char *)strtok(NULL,";");
> snprintf(host_name,sizeof(host_name),"%s",(temp_buffer==NULL)?"":temp_buffer);
> - host_name[sizeof(host_name)]='\x0';
> + host_name[sizeof(host_name) - 1]='\x0';
>
> /* get the service name */
> if(notification_type==SERVICE_NOTIFICATION){
>
Thanks for all the patches Olaf! They will be committed to CVS shortly...
Ethan Galstad,
Nagios Developer
---
Email: [email protected]
Website: http://www.nagios.org
This post was automatically imported from historical nagios-devel mailing list archives
Original poster: [email protected]
> Do not write outside the hostname array.
> snprintf will likely terminate the string anyway.
>
> ---
> cgi/notifications.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> Index: nagios-2.5/cgi/notifications.c
> ===================================================================
> --- nagios-2.5.orig/cgi/notifications.c
> +++ nagios-2.5/cgi/notifications.c
> @@ -553,7 +553,7 @@ void display_notifications(void){
> /* get the host name */
> temp_buffer=(char *)strtok(NULL,";");
> snprintf(host_name,sizeof(host_name),"%s",(temp_buffer==NULL)?"":temp_buffer);
> - host_name[sizeof(host_name)]='\x0';
> + host_name[sizeof(host_name) - 1]='\x0';
>
> /* get the service name */
> if(notification_type==SERVICE_NOTIFICATION){
>
Thanks for all the patches Olaf! They will be committed to CVS shortly...
Ethan Galstad,
Nagios Developer
---
Email: [email protected]
Website: http://www.nagios.org
This post was automatically imported from historical nagios-devel mailing list archives
Original poster: [email protected]