From d95b3d070009dc557d60ead60ab6d820fe8e7e7f Mon Sep 17 00:00:00 2001 From: rpm-build Date: Tue, 16 Nov 2021 14:32:46 +0800 Subject: [PATCH] lnstat: fix buffer overflow in lnstat command segfults when called the following command: [root@localhost ~]lnstat -w 1 Segmentation fault (core dumped) The maximum value of th.num_lines is HDR_LINES(10), h should not be equal to th.num_lines, array th.hdr may be out of bounds. --- misc/lnstat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/misc/lnstat.c b/misc/lnstat.c index e3c8421..7bfb8e6 100644 --- a/misc/lnstat.c +++ b/misc/lnstat.c @@ -210,7 +210,7 @@ static struct table_hdr *build_hdr_string(struct lnstat_file *lnstat_files, ofs += width+1; } /* fill in spaces */ - for (h = 1; h <= th.num_lines; h++) { + for (h = 1; h < th.num_lines; h++) { for (i = 0; i < ofs; i++) { if (th.hdr[h][i] == '\0') th.hdr[h][i] = ' '; -- 1.8.3.1