[src/trunk]: src/usr.sbin/lpr/pac sscanf possible overrun

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/a91e4c2a7a8b
branches:  trunk
changeset: 547360:a91e4c2a7a8b
user:      itojun <itojun%NetBSD.org@localhost>
date:      Sat May 17 14:56:40 2003 +0000

description:
sscanf possible overrun

diffstat:

 usr.sbin/lpr/pac/pac.c |  9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diffs (30 lines):

diff -r 9abdd989ab08 -r a91e4c2a7a8b usr.sbin/lpr/pac/pac.c
--- a/usr.sbin/lpr/pac/pac.c    Sat May 17 14:54:53 2003 +0000
+++ b/usr.sbin/lpr/pac/pac.c    Sat May 17 14:56:40 2003 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: pac.c,v 1.16 2002/07/14 15:28:01 wiz Exp $     */
+/*     $NetBSD: pac.c,v 1.17 2003/05/17 14:56:40 itojun Exp $  */
 
 /*
  * Copyright (c) 1983, 1993
@@ -41,7 +41,7 @@
 #if 0
 static char sccsid[] = "@(#)pac.c      8.1 (Berkeley) 6/6/93";
 #else
-__RCSID("$NetBSD: pac.c,v 1.16 2002/07/14 15:28:01 wiz Exp $");
+__RCSID("$NetBSD: pac.c,v 1.17 2003/05/17 14:56:40 itojun Exp $");
 #endif
 #endif /* not lint */
 
@@ -220,8 +220,9 @@
        int ic;
 
        while (fgets(linebuf, BUFSIZ, acct) != NULL) {
-               if (sscanf(linebuf, "%f %d%s", &t, &ic, who) == 0) {
-                       sscanf(linebuf, "%f %s", &t, who);
+               /* XXX sizeof(who) == 1024 */
+               if (sscanf(linebuf, "%f %d%1023s", &t, &ic, who) == 0) {
+                       sscanf(linebuf, "%f %1023s", &t, who);
                        ic = 1;
                }