From sgrubb at redhat.com  Thu Jul 20 23:28:53 2017
From: sgrubb at redhat.com (Steve Grubb)
Date: Thu, 20 Jul 2017 17:28:53 -0400
Subject: [Rd] [PATCH] Fix fscanf specifier in InIntegerAscii
Message-ID: <1981748.MGpVb1Uv45@x2>

Hello,

The SMBUF_SIZED_STRING allows fscanf to read upto 511 bytes. The buffer
at line 1382 is only 128 bytes. The fscanf format specifier ought to be
resized to prevent a stack overrun.

Signed-of-by: Steve Grubb <sgrubb at redhat.com>

Index: saveload.c
===================================================================
--- src/main/saveload.c	(revision 72935)
+++ src/main/saveload.c	(working copy)
@@ -1379,7 +1379,7 @@
 {
     char buf[128];
     int x, res;
-    res = fscanf(fp, SMBUF_SIZED_STRING, buf);
+    res = fscanf(fp, "%127s", buf);
     if(res != 1) error(_("read error"));
     if (strcmp(buf, "NA") == 0)
 	return NA_INTEGER;



[Rd] [PATCH] Fix fscanf specifier in InIntegerAscii
Steve Grubb