diff options
| -rw-r--r-- | patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch b/patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch new file mode 100644 index 0000000..d4080df --- /dev/null +++ b/patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch @@ -0,0 +1,17 @@ +http://bugs.gentoo.org/340249 +Patch backported from openmotif-2.3.3 + +--- openMotif-2.2.3-orig/lib/Mrm/MrmIheader.c ++++ openMotif-2.2.3/lib/Mrm/MrmIheader.c +@@ -228,9 +228,10 @@ + + { + /* sscanf() may call ungetc(), which would write the XmConst string. */ +- char buf[XtNumber(idb__database_version) + 1]; ++ char *buf = XtMalloc(strlen(idb__database_version) + 1); + strcpy(buf, idb__database_version); + sscanf(buf, "URM %d.%d", &db_major, &db_minor); ++ XtFree(buf); + } + + if ((file_major > db_major) || |