From 50e0694d51f48ca6c142e2e2006802710d076798 Mon Sep 17 00:00:00 2001
From: Roland Mainz <roland.mainz@nrubsig.org>
Date: Wed, 8 Dec 2004 06:16:20 +0000
Subject: =?UTF-8?q?//bugs.freedesktop.org/show=5Fbug.cgi=3Fid=3D1818)=20at?=
 =?UTF-8?q?tachment=20#1286=20=20=20=20=20(https://bugs.freedesktop.org/at?=
 =?UTF-8?q?tachment.cgi=3Fid=3D1286):=20Fixing=20=20=20=20=20off-by-one=20?=
 =?UTF-8?q?allocation=20error.=20Patch=20by=20Kristian=20H=F8gsberg=20=20?=
 =?UTF-8?q?=20=20=20<krh@bitplanet.net>.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pf.c      |  8 ++++++--
 xmodmap.c | 20 ++++++++++++++++----
 xmodmap.h |  2 ++
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/pf.c b/pf.c
index 2cacbdc..ae84403 100644
--- a/pf.c
+++ b/pf.c
@@ -87,8 +87,12 @@ void process_line (buffer)
     int i;
     char *cp;
 
-    len = strlen (buffer);
-
+    /* copy buffer since it may point to unwritable date */
+    len = strlen(buffer);
+    cp = chk_malloc(len + 1);
+    strcpy(cp, buffer);
+    buffer = cp;
+    
     for (i = 0; i < len; i++) {		/* look for blank lines */
 	register char c = buffer[i];
 	if (!(isspace(c) || c == '\n')) break;
diff --git a/xmodmap.c b/xmodmap.c
index a67493f..c59f07b 100644
--- a/xmodmap.c
+++ b/xmodmap.c
@@ -51,6 +51,16 @@ Exit(int status)
     exit (status);
 }
 
+void *
+chk_malloc(size_t n_bytes)
+{
+    void *buf = malloc(n_bytes);
+    if (!buf) {
+	fprintf(stderr, "%s: Could not allocate %d bytes\n", ProgramName, (int)n_bytes);
+	Exit(-1);
+    }
+    return buf;
+}
 
 static char *help_message[] = {
 "\nwhere options include:",
@@ -244,9 +254,10 @@ main(int argc, char *argv[])
 	      case 's':
 	      case 'l':
 	      case 'c': {
-		  char cmd[80];		/* big enough to hold line */
+		  char *cmd;
 		  didAnything = True;
 		  if (++i >= argc) usage ();
+		  cmd = chk_malloc (strlen ("remove control = ") + strlen (argv[i]) + 1);
 		  (void) sprintf (cmd, "remove %s = %s",
 				  ((arg[1] == 's') ? "shift" :
 				   ((arg[1] == 'l') ? "lock" :
@@ -265,10 +276,10 @@ main(int argc, char *argv[])
 	      case '3':
 	      case '4':
 	      case '5': {
-		  char cmd[80];		/* big enough to hold line */
+		  char *cmd;
 		  didAnything = True;
 		  if (++i >= argc) usage ();
-
+		  cmd = chk_malloc (strlen ("add modX = ") + strlen (argv[i]) + 1);
 		  (void) sprintf (cmd, "add mod%c = %s", arg[1], argv[i]);
 		  process_line (cmd);
 		  continue;
@@ -281,9 +292,10 @@ main(int argc, char *argv[])
 	      case 's':
 	      case 'l':
 	      case 'c': {
-		  char cmd[80];		/* big enough to hold line */
+		  char *cmd;
 		  didAnything = True;
 		  if (++i >= argc) usage ();
+		  cmd = chk_malloc (strlen ("add control = ") + strlen (argv[i]) + 1);
 		  (void) sprintf (cmd, "add %s = %s",
 				  ((arg[1] == 's') ? "shift" :
 				   ((arg[1] == 'l') ? "lock" :
diff --git a/xmodmap.h b/xmodmap.h
index 0d2f779..d52ef5e 100644
--- a/xmodmap.h
+++ b/xmodmap.h
@@ -56,3 +56,5 @@ extern void PrintModifierMapping(XModifierKeymap *map, FILE *fp);
 extern void PrintKeyTable(Bool exprs, FILE *fp);
 extern void PrintPointerMap(FILE *fp);
 extern int SetPointerMap(unsigned char *map, int n);
+
+extern void *chk_malloc(size_t n_bytes);
-- 
cgit v1.2.3