Author: fjoe
Date: Thu Nov 24 18:45:23 2011
New Revision: 227947
URL: http://svn.freebsd.org/changeset/base/227947
Log:
calloc +1 DIALOG_LISTITEM to prevent possible wild pointer access
in dlg_default_listitem().
Modified:
head/usr.sbin/tzsetup/tzsetup.c
Modified: head/usr.sbin/tzsetup/tzsetup.c
==============================================================================
--- head/usr.sbin/tzsetup/tzsetup.c Thu Nov 24 18:44:14 2011
(r227946)
+++ head/usr.sbin/tzsetup/tzsetup.c Thu Nov 24 18:45:23 2011
(r227947)
@@ -76,14 +76,14 @@ static int
xdialog_menu(const char *title, const char *cprompt, int height, int width,
int menu_height, int item_no, dialogMenuItem *ditems)
{
- int i, result, choice;
+ int i, result, choice = 0;
DIALOG_LISTITEM *listitems;
DIALOG_VARS save_vars;
dlg_save_vars(&save_vars);
/* initialize list items */
- listitems = dlg_calloc(DIALOG_LISTITEM, item_no);
+ listitems = dlg_calloc(DIALOG_LISTITEM, item_no + 1);
assert_ptr(listitems, "xdialog_menu");
for (i = 0; i < item_no; i++) {
listitems[i].name = ditems[i].prompt;
@@ -111,7 +111,7 @@ xdialog_menu(const char *title, const ch
width = COLS;
again:
- dialog_vars.default_item = ditems[choice].prompt;
+ dialog_vars.default_item = listitems[choice].name;
result = dlg_menu(title, cprompt, height, width,
menu_height, item_no, listitems, &choice, NULL);
switch (result) {
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "[email protected]"
