fix buffer overflow problem; example was really long MANPATH variable

SCCS-vsn: usr.bin/man/man.c 5.25
SCCS-vsn: usr.bin/man/config.c 5.7

diff --git a/usr/src/usr.bin/man/config.c b/usr/src/usr.bin/man/config.c
index eba6d7a..a9e5727 100644 (file)
--- a/usr/src/usr.bin/man/config.c
+++ b/usr/src/usr.bin/man/config.c
@@ -6,7 +6,7 @@
  */
 
 #ifndef lint
  */
 
 #ifndef lint

-static char sccsid[] = "@(#)config.c   5.6 (Berkeley) %G%";
+static char sccsid[] = "@(#)config.c   5.7 (Berkeley) %G%";

 #endif /* not lint */
 
 #include <sys/param.h>
 #endif /* not lint */
 
 #include <sys/param.h>


@@ -66,20 +66,19 @@ getpath(sects)
 }
 
 cadd(add1, len1, add2)
 }
 
 cadd(add1, len1, add2)

-char *add1, *add2;
-register size_t len1;
+       char *add1, *add2;
+       register size_t len1;

 {
        static size_t buflen;
        static char *bp, *endp;
        register size_t len2;
 
        len2 = add2 ? strlen(add2) : 0;
 {
        static size_t buflen;
        static char *bp, *endp;
        register size_t len2;
 
        len2 = add2 ? strlen(add2) : 0;

-       if (!bp || bp + len1 + len2 + 2 >= endp) {
-               if (!(pathbuf = realloc(pathbuf, buflen += 1024)))
+       if (bp == NULL || bp + len1 + len2 + 2 >= endp) {
+               buflen += MAX(len1 + len2 + 2, 1024);
+               if ((pathbuf = realloc(pathbuf, buflen)) == NULL)

                        enomem();
                        enomem();

-               if (!bp)
-                       bp = pathbuf;
-               endp = pathbuf + buflen;
+               endp = (bp = pathbuf) + buflen;

        }
        bcopy(add1, bp, len1);
        bp += len1;
        }
        bcopy(add1, bp, len1);
        bp += len1;

diff --git a/usr/src/usr.bin/man/man.c b/usr/src/usr.bin/man/man.c
index a612a76..abe2dcd 100644 (file)
--- a/usr/src/usr.bin/man/man.c
+++ b/usr/src/usr.bin/man/man.c
@@ -12,7 +12,7 @@ char copyright[] =
 #endif /* not lint */
 
 #ifndef lint
 #endif /* not lint */
 
 #ifndef lint

-static char sccsid[] = "@(#)man.c      5.24 (Berkeley) %G%";
+static char sccsid[] = "@(#)man.c      5.25 (Berkeley) %G%";

 #endif /* not lint */
 
 #include <sys/param.h>
 #endif /* not lint */
 
 #include <sys/param.h>


@@ -106,10 +106,10 @@ main(argc, argv)
 
                tmp = strtok(p_path, ":"); 
                while (tmp) {
 
                tmp = strtok(p_path, ":"); 
                while (tmp) {

-                       (void)sprintf(buf, "%s/", tmp);
+                       (void)snprintf(buf, sizeof(buf), "%s/", tmp);

                        for (av = arorder; *av; ++av)
                                cadd(buf, strlen(buf), *av);
                        for (av = arorder; *av; ++av)
                                cadd(buf, strlen(buf), *av);

-                       tmp = strtok((char *)NULL, ":"); 
+                       tmp = strtok(NULL, ":"); 

                }
                p_path = pathbuf;
        } else if (!(p_path = getpath(section)) && !p_augment) {
                }
                p_path = pathbuf;
        } else if (!(p_path = getpath(section)) && !p_augment) {