Article View: gnu.bash.bug
Article #203Bug in bash 0.99
From: Jean-Daniel Fekete
Date: Mon, 03 Jul 1989 13:31
Date: Mon, 03 Jul 1989 13:31
19 lines
943 bytes
943 bytes
The following code produces a bug in realloc because some text is
copied beyond the allocated area of ``line''.
Fix: check for line length in alias.c and realloc if needed
*** alias.c.~1~ Thu Jun 8 08:51:51 1989
--- alias.c Mon Jul 3 14:55:18 1989
***************
*** 168,173 ****
--- 168,175 ----
return (line);
j = strlen (line);
+ if ((j + i - start) >= line_len)
+ line = (char *)xrealloc (line, line_len += (50 + j + i - start));
strncpy (line + j, string + start, i - start);
line[j + (i - start)] = '\0';
Technical Details
Message-ID:
<8907031331.AA09561@ccvi.c2v.fr>Path:
arc1-ca.pugleaf.net!utzoo!telly!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!ccvi.ccv.fr!jdfShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!telly!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!ccvi.ccv.fr!jdf From: jdf@ccvi.ccv.fr (Jean-Daniel Fekete) Newsgroups: gnu.bash.bug Subject: Bug in bash 0.99 Message-ID: <8907031331.AA09561@ccvi.c2v.fr> Date: 3 Jul 89 13:31:52 GMT Sender: daemon@tut.cis.ohio-state.edu Distribution: gnu Organization: GNUs Not Usenet Lines: 19