[PATCH] Fix menu_add_item segfault
Simon Dawson <[email protected]> Fri, 5 Oct 2012 08:14:36 +0100
| Newsgroups | gmane.comp.sysutils.lcdproc |
|---|---|
| Message-ID | <CAHt8ZCMfrBMkM306NMyTttiKxTyRh4AF+GX=VGt9ebLq_MAu2A@mail.gmail.com> |
Trying to add a menu item using menu_add_item causes a segmentation fault in the LCDd server. This is caused by a read beyond the end of an array. The attached patch adds a safety check on the size of the argument array. _______________________________________________ LCDproc mailing list [email protected] http://lists.omnipotent.net/mailman/listinfo/lcdproc
lcdproc-fix-menu-segfault.patch
(application/octet-stream, 876 B)
Trying to add a menu item using menu_add_item causes a segmentation fault in the LCDd server. This is caused by a read beyond the end of an array. This patch adds a safety check on the size of the argument array. Signed-off-by: Simon Dawson <[email protected]> diff -Nurp a/server/commands/menu_commands.c b/server/commands/menu_commands.c --- a/server/commands/menu_commands.c 2012-10-05 08:00:24.977769471 +0100 +++ b/server/commands/menu_commands.c 2012-10-05 08:02:10.213764781 +0100 @@ -198,7 +198,7 @@ menu_add_item_func(Client *c, int argc, /* call menu_set_item() with a temporarily allocated argv * to process the remaining options */ - if ((argc > 5) || (argv[4][0] == '-')) { + if ((argc > 5) || ((argc == 5) && argv[4][0] == '-')) { // menu_add_item <menuid> <newitemid> <type> [<text>] // menu_set_item <menuid> <itemid> {<option>}+ int i, j;