From 9cef4d5495837b30d955f467f2e9c7c4066764c3 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Sat, 3 Aug 2024 11:52:17 -0700 Subject: [PATCH] Fix unlikely buffer overrun when checkpointing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * src/checkpoint.c (format_checkpoint_string): Don’t overrun buffer when word splitting. --- src/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/checkpoint.c b/src/checkpoint.c index e9ca3523..00079ec2 100644 --- a/src/checkpoint.c +++ b/src/checkpoint.c @@ -300,10 +300,13 @@ format_checkpoint_string (FILE *fp, size_t len, if (arg) { ws.ws_delim = ","; - if (wordsplit (arg, &ws, WRDSF_NOVAR | WRDSF_NOCMD | - WRDSF_QUOTE | WRDSF_DELIM)) + if (wordsplit (arg, &ws, + (WRDSF_NOVAR | WRDSF_NOCMD + | WRDSF_QUOTE | WRDSF_DELIM))) ERROR ((0, 0, _("cannot split string '%s': %s"), arg, wordsplit_strerror (&ws))); + else if (3 < ws.ws_wordc) + ERROR ((0, 0, _("too many words in '%s'"), arg)); else { int i;