[Chicken-users] buffer overflow fixed

[Joerg F. Wittenberger]

Hi,

I came across a possible buffer overflow in version 0.1088!  Here's
the fix:

*** runtime.c~  Sat Jan 11 14:41:50 2003
--- runtime.c   Thu Jan 16 10:41:47 2003
***************
*** 2816,2826 ****
  C_word C_fcall C_execute_shell_command(C_word string)
  {
    int n = C_header_size(string);
  
!   C_memcpy(buffer, ((C_SCHEME_BLOCK *)string)->data, n);
!   buffer[ n ] = '\0';
  
!   if((n = system(buffer)) == -1)
      return C_fix(errno);
  
  #ifdef C_NONUNIX
--- 2816,2834 ----
  C_word C_fcall C_execute_shell_command(C_word string)
  {
    int n = C_header_size(string);
+   char *buf = buffer;
  
!   if(n >= STRING_BUFFER_SIZE) {
!     buf = malloc(n+1);
!     if(!buf) barf(C_OUT_OF_MEMORY_ERROR, "system");
!   }
!   C_memcpy(buf, ((C_SCHEME_BLOCK *)string)->data, n);
!   buf[ n ] = '\0';
  
!   n = system(buf);
!   if(buf != buffer) free(buf);
! 
!   if(n == -1)
      return C_fix(errno);
  
  #ifdef C_NONUNIX

Cheers

/Jörg

-- 
The worst of harm may often result from the best of intentions.