Skip to content

Commit 0264ec0

Browse files
peponejbrandwood
andauthored
Apply modified Debian 05-gniibe-fix-13.patch, to fix heap-based buffer overflow in the do_msg() function (#15)
https://sourceforge.net/p/mcpp/bugs/13/ and CVE-2019-14274 Description: Fix for a bug reported to sourceforge.net #13 by fixing error messages. Also, fix erroneous messages. Author: NIIBE Yutaka The buffer overflow was caused by do_msg() treating illegal control characters in the error message output as tokenized macros that needed to be expanded for printing. This fixes the problem by just not printing the preprocessed source code which contains those illegal control characters. The patch has been reworked to change the error messages to better match those that are output when unterminated strings are encountered. It also changes the other patched messages to restore the 'l' in "%02lx" because do_msg() passes a long integer to mcpp_fprintf(). Co-authored-by: John Brandwood <john.brandwood@telzey.com>
1 parent 45cee5a commit 0264ec0

1 file changed

Lines changed: 6 additions & 6 deletions

File tree

support.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -593,9 +593,9 @@ char * scan_quote(
593593
const char * const unterm_string
594594
= "Unterminated string literal%s";
595595
const char * const unterm_char
596-
= "Unterminated character constant %s%.0ld%s";
596+
= "Unterminated character constant%s";
597597
const char * const empty_const
598-
= "Empty character constant %s%.0ld%s";
598+
= "Empty character constant%s";
599599
const char * skip;
600600
size_t len;
601601
int c;
@@ -652,7 +652,7 @@ char * scan_quote(
652652
if (diag && iscntrl( c) && ((char_type[ c] & SPA) == 0)
653653
&& (warn_level & 1))
654654
cwarn(
655-
"Illegal control character %.0s0lx%02x in quotation" /* _W1_ */
655+
"Illegal control character %.0s0x%02lx in quotation" /* _W1_ */
656656
, NULL, (long) c, NULL);
657657
*out_p++ = c;
658658
chk_limit:
@@ -673,14 +673,14 @@ char * scan_quote(
673673
if (delim == '"') {
674674
cerror( unterm_string, skip, 0L, NULL); /* _E_ */
675675
} else if (delim == '\'') {
676-
cerror( unterm_char, out, 0L, skip); /* _E_ */
676+
cerror( unterm_char, skip, 0L, NULL); /* _E_ */
677677
} else {
678678
cerror( "Unterminated header name %s%.0ld%s" /* _E_ */
679679
, out, 0L, skip);
680680
}
681681
out_p = NULL;
682682
} else if (delim == '\'' && out_p - out <= 2) {
683-
cerror( empty_const, out, 0L, skip); /* _E_ */
683+
cerror( empty_const, skip, 0L, NULL); /* _E_ */
684684
out_p = NULL;
685685
goto done;
686686
}
@@ -1158,7 +1158,7 @@ static char * parse_line( void)
11581158
default:
11591159
if (iscntrl( c)) {
11601160
cerror( /* Skip the control character */
1161-
"Illegal control character %.0s0x%lx, skipped the character" /* _E_ */
1161+
"Illegal control character %.0s0x%02lx, skipped the character" /* _E_ */
11621162
, NULL, (long) c, NULL);
11631163
} else { /* Any valid character */
11641164
*tp++ = c;

0 commit comments

Comments
 (0)