texinfo 4.6.91: fix buffer overflows

This patch fixes some potential buffer overflows in info.

Andreas.

2004-03-14  Andreas Schwab  <[email protected]>

	* info/session.c: Fix buffer overflows.

--- info/session.c
+++ info/session.c
@@ -2169,24 +2169,27 @@
       char *prompt;
 
       /* Build the prompt string. */
-      if (defentry)
-        prompt = (char *)xmalloc (99 + strlen (defentry->label));
-      else
-        prompt = (char *)xmalloc (99);
-
       if (builder == info_menu_of_node)
         {
           if (defentry)
-            sprintf (prompt, _("Menu item (%s): "), defentry->label);
+	    {
+	      prompt = xmalloc (strlen (defentry->label)
+				+ strlen (_("Menu item (%s): ")));
+	      sprintf (prompt, _("Menu item (%s): "), defentry->label);
+	    }
           else
-            sprintf (prompt, _("Menu item: "));
+	    prompt = xstrdup (_("Menu item: "));
         }
       else
         {
           if (defentry)
-            sprintf (prompt, _("Follow xref (%s): "), defentry->label);
+	    {
+	      prompt = xmalloc (strlen (defentry->label)
+				+ strlen (_("Follow xref (%s): ")));
+	      sprintf (prompt, _("Follow xref (%s): "), defentry->label);
+	    }
           else
-            sprintf (prompt, _("Follow xref: "));
+	    prompt = xstrdup (_("Follow xref: "));
         }
 
       line = info_read_completing_in_echo_area (window, prompt, menu);
@@ -2769,13 +2772,15 @@
       /* Look for node names typical for usage nodes in this menu.  */
       for (try_node = invocation_nodes; *try_node; try_node++)
 	{
-	  char nodename[200];
+	  char *nodename;
 
+	  nodename = xmalloc (strlen (program) + strlen (*try_node));
 	  sprintf (nodename, *try_node, program);
 	  /* The last resort "%s" is dangerous, so we restrict it
              to exact matches here.  */
 	  entry = entry_in_menu (nodename, menu,
 				 strcmp (*try_node, "%s") == 0);
+	  free (nodename);
 	  if (entry)
 	    break;
 	}
@@ -2921,7 +2926,7 @@
   REFERENCE **menu = NULL;
   int menu_index = 0, menu_slots = 0;
   char *default_nodename = xstrdup (active_window->node->nodename);
-  char *prompt = xmalloc (40 + strlen (default_nodename));
+  char *prompt = xmalloc (strlen (_("Kill node (%s): ")) + strlen (default_nodename));
 
   sprintf (prompt, _("Kill node (%s): "), default_nodename);
 
@@ -3669,7 +3674,12 @@
 
   if (ask_for_string)
     {
-      prompt = (char *)xmalloc (50 + strlen (search_string));
+      prompt = (char *)xmalloc (strlen (_("%s%sfor string [%s]: "))
+				+ strlen (_("Search backward"))
+				+ strlen (_("Search"))
+				+ strlen (_(" case-sensitively "))
+				+ strlen (_(" "))
+				+ strlen (search_string));
 
       sprintf (prompt, _("%s%sfor string [%s]: "),
                direction < 0 ? _("Search backward") : _("Search"),
@@ -4489,7 +4499,7 @@
     info_error ((char *) _("Unknown command (%s)."), rep, NULL);
   else
     {
-      char *temp = xmalloc (1 + strlen (rep) + strlen (_("\"\" is invalid")));
+      char *temp = xmalloc (1 + strlen (rep) + strlen (_("\"%s\" is invalid")));
       sprintf (temp, _("\"%s\" is invalid"), rep);
       terminal_ring_bell ();
       inform_in_echo_area (temp);

-- 
Andreas Schwab, SuSE Labs, [email protected]
SuSE Linux AG, Maxfeldstraße 5, 90409 Nürnberg, Germany
Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."
_______________________________________________
Texinfo home page: http://www.gnu.org/software/texinfo/
[email protected]
http://ff0.org/mailman/listinfo/texinfo-pretest