Skip to content

Commit fc26756

Browse files
douglasbagnallabartlet
authored andcommitted
printing: avoid crash in LPRng_time
If the string is too shhort we don't want to atoi() whatever is beyond the end of it. Found using Honggfuzz and the fuzz_parse_lpq_entry fuzzer. Signed-off-by: Douglas Bagnall <[email protected]> Reviewed-by: Andrew Bartlett <[email protected]> Autobuild-User(master): Andrew Bartlett <[email protected]> Autobuild-Date(master): Mon Jul 5 05:07:13 UTC 2021 on sn-devel-184
1 parent 16c28b3 commit fc26756

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

source3/printing/lpq_parse.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,10 +223,16 @@ static time_t LPRng_time(char *time_string)
223223
}
224224

225225
if ( atoi(time_string) < 24 ){
226+
if (strlen(time_string) < 7) {
227+
return (time_t)-1;
228+
}
226229
t->tm_hour = atoi(time_string);
227230
t->tm_min = atoi(time_string+3);
228231
t->tm_sec = atoi(time_string+6);
229232
} else {
233+
if (strlen(time_string) < 18) {
234+
return (time_t)-1;
235+
}
230236
t->tm_year = atoi(time_string)-1900;
231237
t->tm_mon = atoi(time_string+5)-1;
232238
t->tm_mday = atoi(time_string+8);

0 commit comments

Comments
 (0)