diff options
| author | Michael Budde <mbudde@gmail.com> | 2019-01-26 09:30:35 +0100 |
|---|---|---|
| committer | Martin Michlmayr <tbm@cyrius.com> | 2019-01-26 09:45:11 -0300 |
| commit | 7c0ae5b02571e21f97d45f5d091cb78af9885713 (patch) | |
| tree | 443385ee9074cdbd85926b515e598c1c0813ba30 /src/times.cc | |
| parent | ba40cd0d0ce825c9be108611d0b59c42f434b6ac (diff) | |
| download | fork-ledger-7c0ae5b02571e21f97d45f5d091cb78af9885713.tar.gz fork-ledger-7c0ae5b02571e21f97d45f5d091cb78af9885713.tar.bz2 fork-ledger-7c0ae5b02571e21f97d45f5d091cb78af9885713.zip | |
Fix possible stack overflow in date parsing routine
It is possible to create a stack overflow by giving a date that is
longer than the buffer that is used during date parsing because the
length of the input string is not checked. The `VERIFY` macro is only
enabled when debug-mode is enabled and the `--verify-memory` argument is
used.
Prevent the issue by always checking the input string length and
discarding dates that does not fit in the buffer as invalid.
This issue has been assigned CVE-2017-12482.
Fixes #1224
Diffstat (limited to 'src/times.cc')
| -rw-r--r-- | src/times.cc | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/times.cc b/src/times.cc index db0d74ff..74773755 100644 --- a/src/times.cc +++ b/src/times.cc @@ -127,7 +127,9 @@ namespace { date_t parse_date_mask_routine(const char * date_str, date_io_t& io, date_traits_t * traits = NULL) { - VERIFY(std::strlen(date_str) < 127); + if (std::strlen(date_str) > 127) { + throw_(date_error, _f("Invalid date: %1%") % date_str); + } char buf[128]; std::strcpy(buf, date_str); |