fix possible buffer overrun
This commit is contained in:
		| @@ -1,3 +1,7 @@ | ||||
| 2001-11-20  Kiyokazu SUTO <suto@ks-and-ks.ne.jp> | ||||
|  | ||||
| 	* frame.c (newFrameSet): fix possible buffer overrun | ||||
|  | ||||
| 2001-11-20  Fumitoshi UKAI  <ukai@debian.or.jp> | ||||
|  | ||||
| 	* XXMakefile config.h: removed from CVS | ||||
|   | ||||
							
								
								
									
										10
									
								
								frame.c
									
									
									
									
									
								
							
							
						
						
									
										10
									
								
								frame.c
									
									
									
									
									
								
							| @@ -1,4 +1,4 @@ | ||||
| /* $Id: frame.c,v 1.4 2001/11/16 22:02:00 ukai Exp $ */ | ||||
| /* $Id: frame.c,v 1.5 2001/11/20 13:17:13 ukai Exp $ */ | ||||
| #include "fm.h" | ||||
| #include "parsetagx.h" | ||||
| #include "myctype.h" | ||||
| @@ -38,8 +38,10 @@ newFrameSet(struct parsed_tag *tag) | ||||
|     if (cols) { | ||||
| 	length[i] = p = cols; | ||||
| 	while (*p != '\0') | ||||
| 	    if (*p++ == ',') | ||||
| 	    if (*p++ == ',') { | ||||
| 		length[++i] = p; | ||||
| 		if (i >= sizeof(length) / sizeof(length[0]) - 2) break; | ||||
| 	    } | ||||
| 	length[++i] = p + 1; | ||||
|     } | ||||
|     if (i > 1) { | ||||
| @@ -74,8 +76,10 @@ newFrameSet(struct parsed_tag *tag) | ||||
|     if (rows) { | ||||
| 	length[i] = p = rows; | ||||
| 	while (*p != '\0') | ||||
| 	    if (*p++ == ',') | ||||
| 	    if (*p++ == ',') { | ||||
| 		length[++i] = p; | ||||
| 		if (i >= sizeof(length) / sizeof(length[0]) - 2) break; | ||||
| 	    } | ||||
| 	length[++i] = p + 1; | ||||
|     } | ||||
|     if (i > 1) { | ||||
|   | ||||
		Reference in New Issue
	
	Block a user